CVE-2016-9449

CVE-2016-9449 affects Drupal core (taxonomy module) on Drupal 7.x before 7.52 and 8.x before 8.2.3. The root cause is an inconsistent use of access query tags (taxonomy_term_access vs term_access) in query alteration, which could disclose taxonomy term information to remote authenticated users. T...

CVE-2016-9450

Drupal core prior to 8.2.3 is affected by CVE-2016-9450 due to an incorrect cache context on the user password reset page, enabling cache-poisoning and potential content spoofing. The issue is fixed in Drupal 8.2.3 (upstream patch). Affected product: Drupal core (Drupal 8.x); root cause: failure ...

CVE-2016-9449

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...

CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

CVE-2016-9452

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...

CVE-2016-9451

CVE-2016-9451 affects Drupal Core (Drupal 7.x) up to version 7.52. Root cause: a flaw in Confirmation forms that enables a remote authenticated user to perform open redirects via specially crafted URLs, potentially enabling phishing. Impact: open redirect to arbitrary sites; exploited by authenti...

CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

CVE-2016-9451

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...

CVE-2016-9451

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...

CVE-2016-9452

Removed by vendor...

CVE-2016-9451

Removed by vendor...

CVE-2016-9450

Removed by vendor...

CVE-2016-9449

Removed by vendor...

PT-2016-7763

Name of the Vulnerable Software and Affected Versions Drupal 8.x versions prior to 8.2.3 Description The issue allows remote attackers to cause a denial of service via a crafted URL, affecting the transliterate mechanism. Recommendations For versions prior to 8.2.3, update to version 8.2.3 or lat...

PT-2016-7761

Name of the Vulnerable Software and Affected Versions Drupal 8.x versions prior to 8.2.3 Description The issue concerns the user password reset form, which allows remote attackers to conduct cache poisoning attacks due to the failure to specify a correct cache context. Recommendations For version...

CVE-2016-9449: Exposure of Sensitive Information to an Unauthorized Actor

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...

CVE-2016-9450: Insufficient Verification of Data Authenticity

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

CVE-2016-9451: URL Redirection to Untrusted Site

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors...

CVE-2016-9452: Improper Input Validation

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...

Drupal Core Phishing Attack Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Core in versions 7.x prior to Drupal 7.52 and 8.x prior to 8.2.3. An attacker can exploit this vulnerability by constructing a malicious...