Cross-Site Request Forgery(CSRF)

drupal/core is vulnerable to cross-site request forgery CSRF attacks. The library does not carry out form token validation early enough, allowing attackers to run the file upload value callbacks with untrusted input...

SQL Injection

drupal/core is vulnerable to SQL injection attacks. It does not escape the user input to the matchoperator parameter, allowing malicious users to inject and execute arbitrary SQL commands through it...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The attacks exist because the library uses the .text function to escape HTML values in views-admin.js...

Denial Of Service (DoS)

drupal/core is vulnerable to denial of service DoS attacks. Attackers can create a large number of image derivatives when the imageallowinsecurederivatives setting is enabled, consuming server disk space...

Timing Attack

drupal/core is vulnerable to timing attacks. The library is vulnerable because it does not compare CSRF tokens with a constant time string comparison which allows malicious users to use the timing of the request to progressively identify a valid CSRF token...

CVE-2015-7877

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7879

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

Cross site scripting

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

Sql injection

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7879

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

CVE-2015-7877

CVE-2015-7877 affects the Drupal User Dashboard module for Drupal 7.x pre-1.4. It describes multiple SQL injection vulnerabilities in the User Dashboard module that allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected software: user_dashboard 7.x versions pri...

CVE-2015-7879

The CVE-2015-7879 issue affects the Drupal Stickynote module for 7.x, before 7.x-1.3. Root cause: insufficient sanitization of note text on the admin listing page, allowing remote authenticated users with create/edit permission to inject arbitrary script or HTML (XSS). Affected versions: Stickyno...

CVE-2015-7877

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

Fedora 25 : drupal8 (2017-902970c18f)

8.3.7 - SA-CORE-2017-004 CVE-2017-6923, CVE-2017-6924, CVE-2017-6925 - 8.3.6 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 26 : drupal8 (2017-0fbd57c134)

8.3.7 - SA-CORE-2017-004 CVE-2017-6923, CVE-2017-6924, CVE-2017-6925 - 8.3.6 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

[SECURITY] Fedora 25 Update: drupal8-8.3.7-1.fc25

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 26 Update: drupal8-8.3.7-1.fc26

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Drupal Views Refresh Refresh Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Views Refresh Refresh module. This allows an attacker to bypass certain security restrictions and perform unauthorized...

Drupal Views Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Views module. The vulnerability allows attackers to bypass certain security restrictions and perform unauthorized...

Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072

The Clientside Validation module enables you to have clientside Javascript validation on your forms. The module does not sufficiently validate parameters of a POST request made when validating a CAPTCHA. For the 1.x version of this module, this vulnerability is mitigated by the fact that the...