CVE-2017-6929

Removed by vendor...

CVE-2017-6927

Removed by vendor...

CVE-2017-6931

In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. Th...

CVE-2017-6931

The CVE concerns Drupal 8.4.x prior to 8.4.5 where the Settings Tray form (in Settings Tray module, contributed or custom) bypasses proper access checks, allowing users to update data they should not modify. The root cause is missing access checks in certain Settings Tray implementations; the Dru...

CVE-2017-6926

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...

CVE-2017-6928

Drupal core 7.x before 7.57 with the private file system is vulnerable to an access bypass where one module grants access to a file while another denies it, due to a conflicting access check. This is mitigated by unusual site configurations but not guaranteed. The issue is addressed in Drupal 7.5...

CVE-2017-6929

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

CVE-2017-6927

CVE-2017-6927 affects Drupal 8.4.x before 8.4.5 and 7.x before 7.57. The issue is a flaw in the Drupal.checkPlain() JavaScript escaping function, which fails to sanitize certain HTML injection methods, enabling cross-site scripting under certain circumstances. The PHP HTML escaping functions are ...

CVE-2017-6928

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another...

CVE-2017-6926

CVE-2017-6926 affects Drupal 8.4.x before 8.4.5 where users with permission to post comments can view content and comments they access to and add comments to that content. The issue’s underlying cause is tied to Drupal’s comment system behavior; mitigations are stated as requiring the comment sys...

CVE-2017-6930

Summary (grounded): CVE-2017-6930 affects Drupal 8.4.x prior to 8.4.5 where, on multilingual sites using node access controls, the untranslated node is incorrectly treated as the default fallback for access queries. This can enable an access bypass. The issue is limited to sites that use the Cont...

CVE-2017-6930

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node...

CVE-2017-6927: Improper Neutralization of Input During Web Page Generation

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous text before outputting it to HTML as JavaScript output does not typically go through Twig autoescaping. This function does not correctly...

CVE-2017-6932: URL Redirection to Untrusted Site

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an externa...

CVE-2017-6930: Undefined Security Weakness

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node...

Drupal Search 404 Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search 404 is one of the modules that searches for keywords in the URL. A cross-site scripting vulnerability exists in the Drupal Search 404 module, which stems from the program failing...

PT-2018-8354

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Description The issue arises when using node access controls with a multilingual site, where Drupal marks the untranslated version of a node as the default fallback for access queries. This can result in an...

PT-2018-8350

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Description The issue allows users with permission to post comments to view content and comments they do not have access to, and also to add comments to this content. This is mitigated by the requirement that...

Drupal 7.x < 7.57 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.57. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Drupal.checkPlain function due to improper handling of HTML injection. A remote attacker, with a...

CVE-2017-6929: Improper Neutralization of Input During Web Page Generation

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...