Flag Lists - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-051

This module enables regular users to create unlimited private flags called lists. The flaglists module doesn't sufficiently filter the output when applying token strings to flaglists links leading to a persistent Cross Site Scripting XSS attack. This vulnerability is mitigated by the fact that an...

Drupal Flag Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in the Drupal Flag module, which allows attackers to bypass security restrictions and perform unauthorized operations...

Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050

Flag enables users to mark content with any number of admin-defined flags, such as 'bookmarks' or 'spam'. Flag Bookmark is a submodule within Flag, which provides a 'bookmarks' flag, and default views to list bookmarked content. The provided view that lists each user's bookmarked content as a tab...

Drupal Instagram Block Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in the Drupal Instagram Block module, which allows attackers to exploit the vulnerability to obtain sensitive information...

Drupal Workbench Scheduler Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in the Drupal Workbench Scheduler module, which could be exploited by an attacker to bypass certain security restrictions and perfor...

Drupal RESTWS Module Page Callback Remote Code Execution

A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted HTTP request to the target server. Successful exploitation could allow the attacker to execute arbitrary code in the context of the web server process...

Workbench Scheduler - Moderately Critical - Access Bypass - SA-CONTRIB-2016-049

Workbench Scheduler module provides users with the ability to create schedules that change moderated content from one workbench moderation state to another. An authenticated user could add a schedule to a node even when that content type has schedules disabled. The vulnerability is mitigated by t...

Drupal Require Login Module Access Privilege Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Require Login is one of the plugins that redirects users to the login page. An access privilege bypass vulnerability exists in the Drupal Require Login module in versions 7.x-2.x prior ...

Drupal Piwik Web Analytics Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Piwik Web Analytics is one of the Piwik web traffic analysis modules. A cross-site scripting vulnerability exists in the Drupal Piwik Web Analytics module in versions 7.x-2.x prior to...

Drupal OAuth2 Client Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OAuth2 Client is one of the client modules used to connect to the OAuth2 server. A cross-site request forgery vulnerability exists in Drupal OAuth2 Client module versions prior to...

Drupal coder module presence unauthenticated remote code execution vulnerability-vulnerability warning-the black bar safety net

! In a review of the coder module secure code when I'm on Drupal Security Advisory SA-CONTRIB-2 0 1 6 years-0 3 9 found that an unauthenticated remote code execution vulnerability. The vulnerability affects Drupal coder module version including 7. the x - 1.3 and 7. x -2.6 all of the following...

Drupal Coder Module coder_upgrade.run.php Remote Code Execution

The vulnerability is due to improper input validation on user-supplied input. remote, unauthenticated attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation could allow the attacker to execute arbitrary code in the context of the proces...

Drupal hosting module access rights bypass vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. hosting is one of the core modules of the Aegir hosting system. An access privilege bypass vulnerability exists in Drupal hosting module versions 7.x-3.x prior to 7.x-3.7. An attacker...

Drupal Panelizer Module Access Privilege Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Panelizer is one of the modules that applies Panels to any node or entity. An access privilege bypass vulnerability exists in the Drupal Panelizer module. An attacker could use this...

Drupal Administration Views Module Access Privilege Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Administration Views is one of the modules used to replace the administration overview or list pages. An access rights bypass vulnerability exists in the Drupal Administration Views...

Drupal Panels Module Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Panels is one of the modules used by site administrators to create customized layouts for multiple users. A security bypass vulnerability exists in the Drupal Panels module. An attacker...

Drupal Google Analytics Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Google Analytics is one of the web traffic analysis modules. A cross-site scripting vulnerability in the Drupal Google Analytics module in versions 7.x-2.x prior to 7.x-2.3 and 8.x-2.x...

Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047

Panels does not check access on some routes Critical Panels allows users with certain permissions to modify the layout and panel panes on pages or entities utilizing panels. Much of the functionality to modify these panels rely on backend routes that call administrative forms. These forms did not...

Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046

The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any cust...

Drupal CODER Module Remote Code Execution

A code execution vulnerability exists in Drupal CODER Module. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...