Drupal 7.x < 7.44 / 8.x < 8.1.3 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 7.x prior to 7.44 or 8.x prior to 8.1.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the Views module that allows an unauthenticated, remote attacker to bypass restrictions and disclose the number of hi...

Debian DSA-3604-1 : drupal7 - security update

A privilege escalation vulnerability has been found in the User module of the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-002. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

FreeBSD : drupal -- multiple vulnerabilities (7932548e-3427-11e6-8e82-002590263bf5)

Drupal Security Team reports : - Saving user accounts can sometimes grant the user all roles User module - Drupal 7 - Moderately Critical - Views can allow unauthorized users to see Statistics information Views module - Drupal 8 - Less Critical %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SECURITY] [DSA 3604-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3604-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 16, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3604-1 (drupal7 - security update)

A privilege escalation vulnerability has been found in the User module of the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-002 . OpenVAS Vulnerability Test $Id: deb3604.nasl 6608 2017-07-07 12:05:05Z...

Views can allow unauthorized users to see Statistics information

More info at https://www.drupal.org/SA-CORE-2016-002...

Saving user accounts can sometimes grant the user all roles

More info at https://www.drupal.org/SA-CORE-2016-002...

Views can allow unauthorized users to see Statistics information

More info at https://www.drupal.org/SA-CORE-2016-002...

Saving user accounts can sometimes grant the user all roles

More info at https://www.drupal.org/SA-CORE-2016-002...

Debian: Security Advisory (DSA-3604-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-002

Saving user accounts can sometimes grant the user all roles User module - Drupal 7 - Moderately Critical A vulnerability exists in the User module, where if some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can be granted all user roles on the...

Views - Less Critical - Access Bypass - SA-CONTRIB-2016-036

An access bypass vulnerability exists in the Views module, where users without the "View content count" permission can see the number of hits collected by the Statistics module for results in the view. This issue is mitigated by the fact that the view must be configured to show a "Content...

drupal -- multiple vulnerabilities

Drupal Security Team reports: Saving user accounts can sometimes grant the user all roles User module - Drupal 7 - Moderately Critical Views can allow unauthorized users to see Statistics information Views module - Drupal 8 - Less Critical...

Node Embed - Less critical - Denial of Service - SA-CONTRIB-2016-034

This module enables you to embed the contents of one node in the body field of another. The module doesn't sufficiently protect against a node being embedded in itself, or a loop being created of one node being embedded in another which is then itself embedded in the first node. This vulnerabilit...

REST JSON - Multiple Vulnerabilities - Highly Critical - Unsupported - SA-CONTRIB-2016-033

This module enables you to expose content, users and comments via a JSON API. The module contains multiple vulnerabilities including Node access bypass Comment access bypass User enumeration Field access bypass User registration bypass Blocked user login Session name guessing Session enumeration...

Page Manager Search - Moderately Critical - Information disclosure - SA-CONTRIB-2016-032

This module enables you to make Panels pages and other pages managed by CTools' Page Manager submodule indexible and searchable through the standard Search module provided in Drupal core. The module doesn't block access to Page Manager pages which have been disabled. CVE identifiers issued ACVE...

Outline Designer - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-035

This module enables you to mass administer book outlines and perform common operations through one interface, improving the usability for the book module. The module doesn't sufficiently sanitize titles when presenting them on this interface. This vulnerability is mitigated by the fact that an...

Opening hours - Moderately Critical - XSS - SA-CONTRIB-2016-031

This module enables you to enter opening hours for locations in a highly detailed way. The module doesn't sufficiently escape input data from user input. This vulnerability is mitigated by the fact that an attacker must be able to edit opening hours by having a role with the permission “Edit...

Drupal CAS Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.CAS is one of the modules of the Java-based single sign-on solution. An information disclosure vulnerability exists in the Drupal CAS module in versions 7.x-1.5 prior to 7.x-1.x, which...

Drupal Embedded Media Field Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Embedded Media Field is one of the modules used to embed third-party video and audio. A security bypass vulnerability in the Drupal Embedded Media Field module 6.x-2.7 before version...