CVE-2017-6927

CVE-2017-6927 affects Drupal 8.4.x before 8.4.5 and 7.x before 7.57. The issue is a flaw in the Drupal.checkPlain() JavaScript escaping function, which fails to sanitize certain HTML injection methods, enabling cross-site scripting under certain circumstances. The PHP HTML escaping functions are ...

CVE-2017-6928

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another...

CVE-2017-6930

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node...

CVE-2017-6932

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an externa...

CVE-2017-6928

Drupal core 7.x before 7.57 with the private file system is vulnerable to an access bypass where one module grants access to a file while another denies it, due to a conflicting access check. This is mitigated by unusual site configurations but not guaranteed. The issue is addressed in Drupal 7.5...

CVE-2017-6932

Drupal core 7.x versions before 7.57 are affected by an external link injection vulnerability in the language switcher block, potentially letting an attacker trick users into navigating to an external site. Affected modules may also exist. Remediation: upgrade to Drupal core 7.57 or later (or app...

CVE-2017-6929

CVE-2017-6929 is a jQuery-based cross-site scripting vulnerability that affects Drupal’s Ajax requests to untrusted domains. Concrete details from connected documents: Drupal 8 was fixed in 8.4.0 via a core upgrade to jQuery 3; Drupal 7 was fixed in the current release (7.57) with jQuery 1.4.4 (t...

CVE-2017-6927

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous text before outputting it to HTML as JavaScript output does not typically go through Twig autoescaping. This function does not correctly...

CVE-2017-6926

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...

CVE-2017-6931

The CVE concerns Drupal 8.4.x prior to 8.4.5 where the Settings Tray form (in Settings Tray module, contributed or custom) bypasses proper access checks, allowing users to update data they should not modify. The root cause is missing access checks in certain Settings Tray implementations; the Dru...

CVE-2017-6929

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

CVE-2017-6930

Summary (grounded): CVE-2017-6930 affects Drupal 8.4.x prior to 8.4.5 where, on multilingual sites using node access controls, the untranslated node is incorrectly treated as the default fallback for access queries. This can enable an access bypass. The issue is limited to sites that use the Cont...

Drupal 7.x < 7.57 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.57. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Drupal.checkPlain function due to improper handling of HTML injection. A remote attacker, with a...

Drupal 8.x < 8.4.5 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.4.5. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not...

Drupal Search 404 Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search 404 is one of the modules that searches for keywords in the URL. A cross-site scripting vulnerability exists in the Drupal Search 404 module, which stems from the program failing...

Debian DLA-1295-1 : drupal7 security update

Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2018-001. For Debian 7 'Wheezy', these problems have been fixed in version 7.14-2+deb7u17. We recommend that you...

[SECURITY] [DLA 1295-1] drupal7 security update

Package : drupal7 Version : 7.14-2+deb7u17 CVE ID : CVE-2017-6927 CVE-2017-6928 CVE-2017-6929 CVE-2017-6932 Debian Bug : 891152 891150 891153 891154 Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream adviso...

Drupal External Link Injection Vulnerability

Drupal core is a free, open source content management system developed in PHP and maintained by the Drupal community. A security vulnerability exists in version 7.x of Drupal core prior to 7.57. An attacker could exploit this vulnerability to navigate users to an external website...

Drupal cross-site scripting vulnerability (CNVD-2018-05186)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal versions 8.4.x prior to 8.4.5 and 7.x prior to 7.57. A remote attacker can exploit this vulnerability to execute...

Drupal Private File Access Bypass Vulnerability

Drupal core is a free, open source content management system developed in PHP and maintained by the Drupal community. A security vulnerability exists in version 7.x of Drupal core prior to 7.57. An attacker can exploit this vulnerability to bypass access restrictions...