drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team reports: CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...

JSON:API - Moderately critical - Multiple Vulnerabilities - SA-CONTRIB-2018-015

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently associate cacheability metadata in certain situations thereby causing an access bypass vulnerability. This vulnerability is mitigated b...

Comment reply form allows access to restricted content.

More info at https://www.drupal.org/SA-CORE-2018-001...

Private file access bypass.

More info at https://www.drupal.org/SA-CORE-2018-001...

Settings Tray access bypass.

More info at https://www.drupal.org/SA-CORE-2018-001...

Private file access bypass.

More info at https://www.drupal.org/SA-CORE-2018-001...

Settings Tray access bypass.

More info at https://www.drupal.org/SA-CORE-2018-001...

jQuery vulnerability with untrusted domains.

More info at https://www.drupal.org/SA-CORE-2018-001...

External link injection on 404 pages when linking to the current page.

More info at https://www.drupal.org/SA-CORE-2018-001...

jQuery vulnerability with untrusted domains.

More info at https://www.drupal.org/SA-CORE-2018-001...

Language fallback can be incorrect on multilingual sites with node access restrictions.

More info at https://www.drupal.org/SA-CORE-2018-001...

JavaScript cross-site scripting prevention is incomplete.

More info at https://www.drupal.org/SA-CORE-2018-001...

Comment reply form allows access to restricted content.

More info at https://www.drupal.org/SA-CORE-2018-001...

External link injection on 404 pages when linking to the current page.

More info at https://www.drupal.org/SA-CORE-2018-001...

Entity API - Moderately critical - Information Disclosure - SA-CONTRIB-2018-013

The Entity API module extends the entity API of Drupal core in order to provide a unified way to deal with entities and their properties. The module prints debugging information to the HTML output in certain error conditions thereby causing an information disclosure vulnerability. This...

Entity Backup - Critical - Module Unsupported - SA-CONTRIB-2018-012

The main purpose of the Entity Backup module is to keep a backup of deleted Drupal core entities and perform recovery of them. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to...

DRUPAL-CONTRIB-2018-008

This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...

Drupal Open Atrium Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform. Multiple cross-site request forgery vulnerabilities exist in subcomponents of the Drupal Open...

Drupal Open Atrium Module OG Subgroups Module Access Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a teamwork development module based on the Drupal platform.OG Subgroups module is one of the OG subgroups module. A security vulnerability exists in the OG...

Drupal Open Atrium module Discussions sub module security vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform.Discussions sub module is one of the sub-modules. A security vulnerability exists in the...