CVE-2017-6926: Exposure of Sensitive Information to an Unauthorized Actor

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...

PT-2018-8350

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Description The issue allows users with permission to post comments to view content and comments they do not have access to, and also to add comments to this content. This is mitigated by the requirement that...

PT-2018-8355

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Description The issue allows users to update certain data without proper permissions, specifically affecting the Settings Tray module. If a Settings Tray form is implemented in a custom or contrib module,...

Drupal 8.x < 8.4.5 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.4.5. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not...

Drupal 7.x < 7.57 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.57. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Drupal.checkPlain function due to improper handling of HTML injection. A remote attacker, with a...

DLA-1295-1 drupal7 - security update

Bulletin has no description...

Drupal External Link Injection Vulnerability

Drupal core is a free, open source content management system developed in PHP and maintained by the Drupal community. A security vulnerability exists in version 7.x of Drupal core prior to 7.57. An attacker could exploit this vulnerability to navigate users to an external website...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (57580fcc-1a61-11e8-97e0-00e04c1ea73d)

Drupal Security Team reports : CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...

Debian DSA-4123-1 : drupal7 - security update

Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2018-001 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Drupal Access Control Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Settings Tray module is one of the Tray settings modules. A security vulnerability exists in the Settings Tray module in Drupal. An attacker can exploit this vulnerability to update...

Drupal LDAP Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in the Drupal LDAP module. It allows an attacker to provide unexpected input and potentially bypass the input validation protection...

Drupal Private File Access Bypass Vulnerability

Drupal core is a free, open source content management system developed in PHP and maintained by the Drupal community. A security vulnerability exists in version 7.x of Drupal core prior to 7.57. An attacker can exploit this vulnerability to bypass access restrictions...

Drupal cross-site scripting vulnerability (CNVD-2018-05185)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. jQuery is one of the JavaScript libraries used in it. A cross-site scripting vulnerability exists in jQuery in Drupal versions 8 and 7. A remote attacker can exploit this vulnerability...

Drupal cross-site scripting vulnerability (CNVD-2018-05186)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal versions 8.4.x prior to 8.4.5 and 7.x prior to 7.57. A remote attacker can exploit this vulnerability to execute...

Drupal Information Disclosure Vulnerability (CNVD-2018-05187)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Drupal version 8.4.x prior to 8.4.5. An attacker could use the vulnerability to view content and comments that require permissions, and...

PT-2018-8356

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 7.57 Description The issue allows an attacker to inject external links, potentially tricking users into navigating to unwanted sites when the language switcher block is used. Similar vulnerabilities exist in vario...

PT-2018-8351

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Drupal versions 7.x before 7.57 Description The issue arises from the Drupal.checkPlain JavaScript function, which is intended to escape potentially dangerous text before it is outputted to HTML. However, thi...

PT-2018-8353

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.4.0 Drupal 7 versions prior to 7.57 Description A cross-site scripting issue is present in jQuery when making Ajax requests to untrusted domains. This issue requires contributed or custom modules to be exploitable...

PT-2018-8352

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 7.57 Description The issue arises when using Drupal's private file system. Under certain conditions, where one module grants access to a file and another denies it, the access check fails. This leads to an access...

Drupal Site Verify Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site footing vulnerability exists in the Drupal Site Verify module, which stems from the program failing to adequately validate user input. An attacker can exploit...