Drupal CMS: source code security analysis report

Several vulnerabilities were discovered in Drupal Association 'Drupal CMS' software: Incorrect User Input Filtration when Generating Code on the Fly Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Hardcoded Credentials Using Insufficiently Random...

Fieldable Panels Panes - Moderately Critical - XSS - SA-CONTRIB-2016-025

This module enables you to create fieldable entities that have special integration with Panels. The module doesn't sufficiently filter the entity title or admin title fields when they are displayed in either the Panels admin UI or the In-Place Editor IPE, allowing for specially crafted XSS attack...

Open Atrium Notifications - Less Critical - Information Disclosure - SA-CONTRIB-2016-026

Open Atrium is a distribution of Drupal that allows you to build collaborative web sites. The Open Atrium Notification module adds the ability to send email notifications to users subscribed to certain content. When combined with the Open Atrium Mailhandler app, incoming email replies to...

[SECURITY] Fedora 22 Update: drupal7-block_class-2.3-1.fc22

Block Class allows users to add classes to any block through the block's configuration interface. By adding a very short snippet of PHP to a theme's block.tpl.php file, classes can be added to the parent element of a block. This package provides the following Drupal module: blockclass...

Fedora 24 : drupal7-block_class-2.3-1.fc24 (2016-687b3a3d5d)

7.x-2.3 The security update 2.2 broke very common class names, see 2636548: upgrade to 2.2 converts class underscore to dash. 7.x-2.2 Fixes Block Class- Critical - Cross Site Scripting XSS - SA- CONTRIB-2015-175 Note that Tenable Network Security has extracted the preceding description block...

Fedora 22 : drupal7-block_class-2.3-1.fc22 (2016-8d983eeb13)

7.x-2.3 The security update 2.2 broke very common class names, see 2636548: upgrade to 2.2 converts class underscore to dash. 7.x-2.2 Fixes Block Class- Critical - Cross Site Scripting XSS - SA- CONTRIB-2015-175 Note that Tenable Network Security has extracted the preceding description block...

Organic groups - Moderately Critical - Access bypass - DRUPAL-SA-CONTRIB-2016-023

This module enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate among themselves. Selective groups require approval in order to become a member, or even invitation-only groups. Under the certain fiel...

Search API - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-022

This module enables you to build searches using a wide range of features, data sources and backends. Search index not updated by node access changes The module doesn't sufficiently re-index nodes when using the "Node access" or "Access check" data alterations and non-standard ways of changing nod...

Drupal Block Class module cross-site scripting vulnerability (CNVD-2016-02374)

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . Drupal Block Class module 7.x-2.2 before the 7.x-2.x version of a...

[SECURITY] Fedora 24 Update: drupal7-block_class-2.3-1.fc24

Block Class allows users to add classes to any block through the block's configuration interface. By adding a very short snippet of PHP to a theme's block.tpl.php file, classes can be added to the parent element of a block. This package provides the following Drupal module: blockclass...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

Cross site scripting

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

CVE-2016-3144

CVE-2016-3144 affects the Drupal Block Class module (7.x-2.x) with remote XSS via a crafted class name when an attacker has Administer block classes permission. Root cause: improper handling of class names in 7.x-2.x prior to 7.x-2.2, enabling injection of script/HTML. Impact: cross-site scriptin...

PT-2016-5384

Name of the Vulnerable Software and Affected Versions Drupal Block Class module versions 7.x-2.x before 7.x-2.2 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a clas...

CVE-2016-3144: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

Features - Less Critical - Denial of Service (DoS) - SA-CONTRIB-2016-020

This module enables you to organize and export configuration data. The module doesn't sufficiently protect the admin/structure/features/cleanup path with a token. If an attacker can trick an admin with the "manage features" permission to request a special URL, it could lead to clearing the cache...

Boost - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-021

This module provides static page caching for Drupal enabling a very significant performance and scalability boost for sites that receive mostly anonymous traffic. The module doesn't prevent form cache from leaking between anonymous users which could result in information disclosure, where one use...

CVE-2016-3171

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation...

CVE-2016-3171

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation...