CVE-2017-6927

CVE-2017-6927 affects Drupal 8.4.x before 8.4.5 and 7.x before 7.57. The issue is a flaw in the Drupal.checkPlain() JavaScript escaping function, which fails to sanitize certain HTML injection methods, enabling cross-site scripting under certain circumstances. The PHP HTML escaping functions are ...

CVE-2017-6928

Removed by vendor...

CVE-2017-6927

Removed by vendor...

CVE-2017-6926

CVE-2017-6926 affects Drupal 8.4.x before 8.4.5 where users with permission to post comments can view content and comments they access to and add comments to that content. The issue’s underlying cause is tied to Drupal’s comment system behavior; mitigations are stated as requiring the comment sys...

CVE-2017-6931

In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. Th...

CVE-2017-6932

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an externa...

CVE-2017-6932

Drupal core 7.x versions before 7.57 are affected by an external link injection vulnerability in the language switcher block, potentially letting an attacker trick users into navigating to an external site. Affected modules may also exist. Remediation: upgrade to Drupal core 7.57 or later (or app...

CVE-2017-6928

Drupal core 7.x before 7.57 with the private file system is vulnerable to an access bypass where one module grants access to a file while another denies it, due to a conflicting access check. This is mitigated by unusual site configurations but not guaranteed. The issue is addressed in Drupal 7.5...

CVE-2017-6930

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node...

CVE-2017-6928

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another...

CVE-2017-6929

CVE-2017-6929 is a jQuery-based cross-site scripting vulnerability that affects Drupal’s Ajax requests to untrusted domains. Concrete details from connected documents: Drupal 8 was fixed in 8.4.0 via a core upgrade to jQuery 3; Drupal 7 was fixed in the current release (7.57) with jQuery 1.4.4 (t...

CVE-2017-6930

Summary (grounded): CVE-2017-6930 affects Drupal 8.4.x prior to 8.4.5 where, on multilingual sites using node access controls, the untranslated node is incorrectly treated as the default fallback for access queries. This can enable an access bypass. The issue is limited to sites that use the Cont...

CVE-2017-6929

Removed by vendor...

CVE-2017-6931

The CVE concerns Drupal 8.4.x prior to 8.4.5 where the Settings Tray form (in Settings Tray module, contributed or custom) bypasses proper access checks, allowing users to update data they should not modify. The root cause is missing access checks in certain Settings Tray implementations; the Dru...

CVE-2017-6927

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous text before outputting it to HTML as JavaScript output does not typically go through Twig autoescaping. This function does not correctly...

CVE-2017-6929

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

CVE-2017-6926

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the...

CVE-2017-6932

Removed by vendor...

Drupal 8.x < 8.4.5 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.4.5. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Comment Reply Form. An authenticated remote attacker could add or view comments that they do not...

Drupal 7.x < 7.57 Multiple Vulnerabilities (SA-CORE-2018-001)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.57. It is, therefore, affected by multiple vulnerabilities : - A flaw exists with the Drupal.checkPlain function due to improper handling of HTML injection. A remote attacker, with a...