Fieldable Panels Panes - Moderately Critical - Access Bypass - SA-CONTRIB-2016-014

This module enables you to create fieldable entities that have special integration with Panels. The module doesn't check access permissions on a file when it is attached to a field on a Fieldable Panels Panes entity that has been made private and where the file field is set to store files using t...

Node Notify - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-013

Node Notify is a lightweight module to allow subscription to comments on nodes for registered and anonymous users. The module doesn't sufficiently sanitize some user provided content, leading to a Cross Site Scripting vulnerability. Additionally, some paths were not protected against CSRF. An...

Google Analytics Counter - Moderately Critical - CSRF - SA-CONTRIB-2016-011

The Google Analytics Counter module provides total pageview counts for each page on a website. In that it is similar to the core Statistics module counter, but it is much lighter and ultimately faster because it draws on data from Google Analytics. This is why it is also able to effortlessly coun...

[SECURITY] [DSA 3498-1] drupal7 security advisory

------------------------------------------------------------------------- Debian Security Advisory DSA-3498-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 28, 2016 https://www.debian.org/security/faq -...

PT-2016-5391

Name of the Vulnerable Software and Affected Versions Drupal versions 7.x prior to 7.43 Drupal versions 8.x prior to 8.0.4 Description The issue allows remote authenticated users to bypass access restrictions. This can lead to reading, deleting, or substituting a link to a file uploaded to an...

PT-2016-5393

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.37 Drupal versions 7.x through 7.42 Drupal versions 8.x through 8.0.3 Description The issue allows remote attackers to conduct open redirect attacks by leveraging custom code or a form shown on a 404 error page,...

PT-2016-5392

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.37 Drupal versions 7.x through 7.42 Description The XML-RPC system might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method...

PT-2016-5399

Name of the Vulnerable Software and Affected Versions Drupal versions 7.x before 7.43 Drupal versions 8.x before 8.0.4 Description The issue allows remote attackers to obtain sensitive username information. This is possible by leveraging a configuration that permits using an email address to logi...

PT-2016-5398

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.38 Drupal versions 7.x prior to 7.43 Description The issue allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user save function with an explicit category and loads...

PT-2016-5397

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.38 Drupal versions 7.x prior to 7.43 Description The issue might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded...

FreeBSD : drupal -- multiple vulnerabilities (59a0af97-dbd4-11e5-8fa8-14dae9d210b8)

Drupal Security Team reports : - File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical - Brute force amplification attacks via XML-RPC XML-RPC server - Drupal 6 and 7 - Moderately Critical - Open redirect via path manipulation Base system - Drupal 6, 7...

Drupal Update Fixes 10 Vulnerabilities, One Critical

Developers at Drupal addressed 10 vulnerabilities in the content management system this week, including a critical access bypass issue that could have let users access certain elements thought to be blocked, and another issue that could lead to remote code execution. Through the critical access...

FileField - Denial of Service - SA-CONTRIB-2016-008

FileField module allows users to upload files in conjunction with the Content Construction Kit CCK module in Drupal 6. The module doesn't validate that a request to delete a temporary file was made by the user who uploaded the file. An attacker can use this vulnerability to delete other user's fi...

Drupal Nodejs Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language maintained by the Drupal community.Node.js is one of the modules that provides real-time push updates. An access bypass vulnerability exists in the Drupal Nodejs module. This vulnerability allows attackers to...

Drupal Releases Security Updates

Drupal has released updates to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected website. Available updates include: Drupal core 6.38 for 6.x users Drupal core 7.43 for 7.x users Drupal core 8.0.4 for 8.0.x...

Drupal Commerce Authorize.Net Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. commerce Authorize.Net is one of the e-commerce payment and billing system modules. An access bypass vulnerability exists in the Drupal Commerce Authorize.Net module versions prior to...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001

File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical A vulnerability exists in the File module that allows a malicious user to view, delete or substitute a link to a file that the victim has uploaded to a form while the form has not yet been submitted...

drupal -- multiple vulnerabilities

Drupal Security Team reports: File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical Brute force amplification attacks via XML-RPC XML-RPC server - Drupal 6 and 7 - Moderately Critical Open redirect via path manipulation Base system - Drupal 6, 7 and 8 ...

Drupal 8.0.x-dev Cross Site Scripting

DOM Based XSS with character on IE8 and older versions IMPORTANT: this issue has been cleared for public discussion and resolution by the Drupal Security Team based on the low evidence of vulnerable browsers still existing. Problem/Motivation filterxss does not filter out the accent grave...

Joomla Joins WordPress As TeslaCrypt Ransomware Target

Exploit kits infecting thousands of WordPress websites are setting their sights on the open-source content management system Joomla in a new campaign spotted by a researcher at the SANS Institute’s Internet Storm Center. “The group behind the WordPress ‘admedia’ campaign is now apparently targeti...