Arbitrary file deletion

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...

UBUNTU-CVE-2016-3162

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...

UBUNTU-CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...

CVE-2016-3162

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...

CVE-2016-3170

The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in...

CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...

CVE-2016-3170

The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in...

CVE-2016-3167

Open redirect vulnerability in the drupalgoto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter...

CVE-2016-3164

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...

CVE-2016-3165

The issue CVE-2016-3165 affects Drupal 6.x before 6.38 where the Form API fails to enforce access restrictions on submit buttons. The server-side form definition may mark a button as #access = FALSE, yet a form submission can still be accepted if the attacker has permission to submit the form, ef...

CVE-2016-3163

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method...

CVE-2016-3165

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "access" set to FALSE in the server-side form definition...

CVE-2016-3169

The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the usersave function with an explicit category and loads all roles into the array...

CVE-2016-3162

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...

CVE-2016-3162

The CVE-2016-3162 issue affects Drupal's File module (Drupal 7.x before 7.43 and 8.x before 8.0.4). The root cause is an access-control bypass that lets remote authenticated users who can create content or upload files read, delete, or substitute a link to a file uploaded to an unprocessed form. ...

CVE-2016-3170

Drupal Core CVE-2016-3170 affects Drupal 7.x before 7.43 and Drupal 8.x before 8.0.4. The issue arises when a configuration allows login by email and a module permits logging in, enabling remote attackers to disclose usernames via the Forgot Password workflow. The vulnerability is confirmed by NV...

CVE-2016-3169

CVE-2016-3169 affects the Drupal core User module: Drupal 6.x versions before 6.38 and 7.x versions before 7.43 are vulnerable. The root cause is code paths that call user_save with an explicit category and load all roles into the roles array, enabling remote privilege escalation. Impact: attacke...

CVE-2016-3166

CVE-2016-3166 describes a CRLF injection in Drupal 6.x before 6.38 when used with PHP before 5.1.2, due to the drupal_set_header function. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting by leveraging a module that outputs user-submitted data...

CVE-2016-3163

CVE-2016-3163 affects the Drupal core XML-RPC subsystem. Drupal 6.x prior to 6.38 and 7.x prior to 7.43 allows remote attackers to perform brute‑force attacks by issuing a large number of calls to the same XML-RPC method, potentially aiding password guessing. Mitigation in public advisories: appl...

CVE-2016-3166

CRLF injection vulnerability in the drupalsetheader function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP...