[SECURITY] Fedora 21 Update: drupal6-cck-2.10-1.fc21

The Content Construction Kit allows you to add custom fields to custom content types using a web interface. In Drupal 5.x, custom content types can be created in Drupal core, and the Content Construction Kit allows you to add custom fields to any content type. In Drupal 7 and later, most of the...

Fedora 22 : drupal7-views_bulk_operations-3.3-1.fc22 (2015-11318)

7.x-3.3 See SA-CONTRIB-2015-131 Changes since 7.x-3.2: - Fix security vulnerability, by AdamPS. - Remove an entitylabel workaround that core no longer needs. - Issue 2427381 by axel.rutz: Rules component lacks entity type - Issue 2418751 by anrikun: Archive action fails silently - Issue 2318273 b...

[SECURITY] Fedora 22 Update: drupal7-views_bulk_operations-3.3-1.fc22

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131

The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled suc...

HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module allows account creation through social login when the configuration is set to allow user registration by...

Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129

Shibboleth authentication module allows users to log in and get permissions based on federated SAML2 authentication. The module didn't filter the text that is displayed as a login link. This vulnerability was mitigated by the fact that an attacker must have a role with the permission Administer...

CVE-2015-3233

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Open redirect

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-3233

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-3232

Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter...

Default configuration

The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache...

CVE-2015-3233

CVE-2015-3233 is an open redirect vulnerability in the Drupal Overlay module for Drupal 7.x, caused by insufficient URL validation. It affects Drupal 7.x prior to 7.38 (per CVE description). Debi an advisory notes fixes across Drupal7 packages in multiple releases (e.g., Wheezy: 7.14-2+deb7u10; J...

CVE-2015-3231

Drupal 7.x (before 7.38) renders cache data by user role in its Render caching system. Affected component is the Render cache, which can leak private content viewed by user 1 to remote authenticated users by reading the cache. Root cause described across multiple sources: caching by user role inc...

CVE-2015-3232

CVE-2015-3232 is an open redirect vulnerability in the Drupal Field UI module for Drupal 7.x prior to 7.38. The flaw allows remote attackers to redirect users to arbitrary sites and conduct phishing via the destinations parameter. The vulnerability is tied to the Drupal 7.38 release, which fixes ...

CVE-2015-3233

Removed by vendor...

CVE-2015-3232

Removed by vendor...

Drupal 7.x < 7.38 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 7.x prior to 7.38. It is, therefore, potentially affected by the following vulnerabilities : - An open redirect vulnerability exists due to improper validation of user-supplied input to the 'destinations' parameter in the Field UI modul...

The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-121

The eXtensible Catalog Drupal Toolkit is a set of Drupal modules to harvest records of the XC Schema format from a Metadata Services Toolkit MST. The XC NCIP Provider module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause a user with "administer ncip providers"...

Apache Solr Real-Time - Critical - Access Bypass - SA-CONTRIB-2015-119

This module allows content-changes to be committed to Apache Solr in real-time. The module doesn't check the status of an entity being indexed which means that unpublished content will get indexed by Solr and the title and partial content may be exposed to any user who has permission to search si...

CVE-2015-4386

Multiple cross-site scripting XSS vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing 1 comments, 2 taxonomy terms, or 3 nodes...