Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061

The Views Send module enables you to send mail to multiple users from a View. The module doesn't sufficiently filter potential user-supplied data when previewing the e-mail which can lead to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker mus...

Drupal Tripal BLAST UI Module Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal Tripal BLAST UI module, which can be exploited by an attacker to execute arbitrary code in the context of an...

Like/Dislike - Critical - Cross Site Request Forgery - SA-CONTRIB-2016-056

Cross Site Request Forgery Like/Dislike module can be used to Like and Dislike actions on any content. It is powered by Drupal field concept. The module does not verify user intent on like/dislike links thereby exposing a Cross Site Request Forgery CSRF vulnerability. CVE identifiers issued ACVE...

Workbench Moderation - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-060

This module enables you to create and manage custom editorial workflows around a site's content. The module could result in unpublished content being temporarily made visible via content lists, e.g. as generated by Views, when its editorial status was being changed, e.g. from "draft" to "needs...

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...

Bootstrap - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-058

The Bootstrap theme enables you to integrate the Bootstrap framework with Drupal. The theme does not sufficiently filter potential user-supplied data when it's passed to certain templates can which lead to a Persistent Cross Site Scripting XSS vulnerability. CVE identifiers issued ACVE identifier...

Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055

This module enables users to create menu items that render views instead of links. This is useful for creating "mega-menus". The module doesn't sufficiently filter title and breadcrumb fields for possible cross-site scripting. This vulnerability is mitigated by the fact that an attacker must have...

Drupal 7.x < 7.20 DoS

Binary data 9726.prm...

Drupal 8.1.x < 8.1.10 Multiple Vulnerabilities

Binary data 9729.prm...

Drupal 7.x < 7.34 DoS

Binary data 9728.prm...

Drupal 7.x < 7.13 Multiple Vulnerabilities

Binary data 9724.prm...

Drupal 7.x < 7.19 Multiple Vulnerabilities

Binary data 9725.prm...

Drupal 7.x < 7.24 Multiple Vulnerabilities

Binary data 9727.prm...

Drupal Elysia Cron Module Cross-Site Scripting Vulnerability

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP language , Elysia Cron is one of the cron job management module . A cross-site scripting vulnerability exists in several versions of Elysia Cron, which can be exploited by attackers ...

Tripal BLAST UI - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-054

This module enables you to run NCBI BLAST jobs on the host system. The module doesn't sufficiently validate advanced options available to users submitting BLAST jobs, thereby exposing the ability to enter a short snippet of shell code that will be executed when the BLAST job is run. This...

Drupal Webform Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in Drupal Webform Module, which can be exploited by an attacker to bypass certain security mechanisms and perform unauthorized...

Webform - Less Critical - Access Bypass - SA-CONTRIB-2016-053

This module provides a user interface to create and configure forms called Webforms. When using forms with private file uploads, Webform wasn't explicitly denying access to files it managed which could allow access to be granted by other modules. The vulnerability is mitigated by the fact that...

Drupal 8.x < 8.1.10 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 8.x prior to 8.1.10. It is, therefore, affected by multiple vulnerabilities : - A flaw exists due to improper checking for 'Administrator comments' permissions, which allows users who have rights to edit a node to set the visibility for...

Elysia Cron - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-052

This module enables you to manage cron jobs. The module doesn't sufficiently sanitize the cron rules which are entered into "Predefined rules" field thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Drupal Core Access Bypass Vulnerability (CNVD-2016-08687)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability in the system.temporary route in version 8.x of Drupal prior to 8.1.10 can be exploited by a remote attacker to bypass established access...