CVE-2016-9452

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...

CVE-2016-9449

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...

Information disclosure

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...

CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

CVE-2016-9449

CVE-2016-9449 affects Drupal core (taxonomy module) on Drupal 7.x before 7.52 and 8.x before 8.2.3. The root cause is an inconsistent use of access query tags (taxonomy_term_access vs term_access) in query alteration, which could disclose taxonomy term information to remote authenticated users. T...

CVE-2016-9450

Drupal core prior to 8.2.3 is affected by CVE-2016-9450 due to an incorrect cache context on the user password reset page, enabling cache-poisoning and potential content spoofing. The issue is fixed in Drupal 8.2.3 (upstream patch). Affected product: Drupal core (Drupal 8.x); root cause: failure ...

CVE-2016-9451

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...

CVE-2016-9452

CVE-2016-9452 affects Drupal Core via the transliterate mechanism in Drupal 8.x (pre-8.2.3). A specially crafted URL can cause a denial of service, potentially stopping the application. Affected product: Drupal Core 8.x before 8.2.3. Root cause: issue in transliterate handling that can be trigger...

CVE-2016-9452

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...

CVE-2016-9451

CVE-2016-9451 affects Drupal Core (Drupal 7.x) up to version 7.52. Root cause: a flaw in Confirmation forms that enables a remote authenticated user to perform open redirects via specially crafted URLs, potentially enabling phishing. Impact: open redirect to arbitrary sites; exploited by authenti...

CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

CVE-2016-9449

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...

Drupal Core Phishing Attack Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Core in versions 7.x prior to Drupal 7.52 and 8.x prior to 8.2.3. An attacker can exploit this vulnerability by constructing a malicious...

Debian DLA-715-1 : drupal7 security update

Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-005. For Debian 7 'Wheezy', these problems have been fixed in version 7.14-2+deb7u15. We recommend that you...

[SECURITY] [DLA 715-1] drupal7 security update

Package : drupal7 Version : 7.14-2+deb7u15 CVE ID : CVE-2016-9449 CVE-2016-9451 Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-005. For Debian 7 "Wheezy",...

Drupal 7.x < 7.52 / 8.x < 8.2.3 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 7.x prior to 7.52 or 8.x prior to 8.2.3. It is, therefore, affected by the multiple vulnerabilities : - An information disclosure vulnerability exists in the taxonomy module when using access query tags that are inconsistent with the...

[ASA-201611-20] drupal: multiple issues

Arch Linux Security Advisory ASA-201611-20 ========================================== Severity: Medium Date : 2016-11-19 CVE-ID : CVE-2016-9449 CVE-2016-9450 CVE-2016-9452 Package : drupal Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The...

Drupal Fixes 'Moderately Critical' Vulnerabilities in Core Engine

The Drupal Security Team fixed a handful of issues in version 7 and 8 of its content management system core engine this week that could have led to cache poisoning, social engineering attacks and a denial of service condition. Drupal SA-CORE-2016-005 – Moderately Critical Update to Drupal core 7....

Debian DSA-3718-1 : drupal7 - security update

Multiple vulnerabilities has been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-005 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Drupal Core Denial of Service Vulnerability (CNVD-2016-11384)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A denial-of-service vulnerability exists in Drupal Core, which can be exploited by attackers to cause a denial-of-service attack...