480 matches found
RESTful - Moderately Critical - Access Bypass - SA-CONTRIB-2017-018
This module enables you to build a RESTful API for your Drupal site. The restfultokenauth module a sub-module doesn't validate the status of users when logging them in. This results in a blocked user being able to operate normally with the RESTful actions, even after being blocked. This...
Metatag -Moderately Critical - Information disclosure - SA-CONTRIB-2017-019
This module enables you to add a variety of meta tags to a site for helping with a site's search engine results and to customize how content is shared on social networks. The module doesn't sufficiently protect against data being cached that might contain information related to a specific user...
Search API Sorts - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-016
The Search API Sorts module allows the site administrator to configure custom sort options for their search results and expose the control interface via the core block system. The module doesn't sufficiently sanitise the name of the sort option which is displayed to users. This vulnerability is...
[SECURITY] Fedora 24 Update: drupal7-title-1.0-0.7.alpha9.fc24
While working on the new content translation system http://api.drupal.org/api/group/fieldlanguage/7 for Drupal 7, we the Dr upal core i18n team faced the need to convert node titles to the Field API in o rder to make nodes fully translatable. We were not able to make this happen in Drupal 7 core ...
[SECURITY] Fedora 25 Update: drupal7-title-1.0-0.7.alpha9.fc25
While working on the new content translation system http://api.drupal.org/api/group/fieldlanguage/7 for Drupal 7, we the Dr upal core i18n team faced the need to convert node titles to the Field API in o rder to make nodes fully translatable. We were not able to make this happen in Drupal 7 core ...
OAuth - Less Critical - Access Bypass - SA-CONTRIB-2017-006
This module enables you to use the OAuth 1.a protocol to authenticate requests. The module does not does not implement the OAuth 1.0a security fix reported at https://oauth.net/advisories/2009-1/. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance wit...
Unpublished 404 - Critical - Access bypass - SA-CONTRIB-2017-021
The purpose of Unpublished 404 module is to emit a 404 error when a user tries to access a unpublished pages. Unpublished 404 7.x-1.0 has an access bypass vulnerability. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team...
OpenLucius - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-004
OpenLucius is a work management platform for social communication, documentation, and projects. The distribution doesn't sufficiently use tokens when marking messages for users as read thereby exposing a Cross Site Request Forgery CSRF vulnerability. The distribution does not sufficiently filter...
Open redirect
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...
CVE-2016-9451
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...
CVE-2016-9451
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...
CVE-2016-9451
CVE-2016-9451 affects Drupal Core (Drupal 7.x) up to version 7.52. Root cause: a flaw in Confirmation forms that enables a remote authenticated user to perform open redirects via specially crafted URLs, potentially enabling phishing. Impact: open redirect to arbitrary sites; exploited by authenti...
CVE-2016-9451
Removed by vendor...
Drupal 7.x < 7.19 Multiple Vulnerabilities
Binary data 9725.prm...
Drupal 7.x < 7.24 Multiple Vulnerabilities
Binary data 9727.prm...
Drupal 7.x < 7.20 DoS
Binary data 9726.prm...
Drupal 7.x < 7.34 DoS
Binary data 9728.prm...
Elysia Cron - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-052
This module enables you to manage cron jobs. The module doesn't sufficiently sanitize the cron rules which are entered into "Predefined rules" field thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...