Cross-site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the strings in the exception backtrace, allowing a malicious user to inject and execute arbitrary web script through an exception...

DRUPAL-CONTRIB-2017-091

The Configuration Update Reports sub-module in the Configuration Update module project enables you to run reports to see what configuration on your site differs from the configuration distributed by a module, theme, or installation profile, and to revert, delete, or import configuration. This...

CMSsc4n - Tool to identify if a domain is a CMS such as Wordpress, Moodle, Joomla, Drupal or Prestashop

Tool to identify if a domain is a CMS such as Wordpress, Moodle, Joomla, Drupal or Prestashop. Use python cmssc4n.py -h / | / |/ | | || | | | | \ / | | || | | | | |/| |\ / |/ | | ' \ | || | | | \ \ | | | | | | || ||/|/| || || || Tool to scan if a domain is a CMS Wordpress , Drupal, Joomla,...

Services single sign-on client - Critical - Cross-site scripting - SA-CONTRIB-2017-087

This module allows users of a remote Services-enabled Drupal site to sign on to a second site with their credentials. The module does not sanitize information from the request before displaying it, thereby exposing a cross-site scripting vulnerability...

Domain Integration (Drupal 7) - Moderately critical - Access bypass - SA-CONTRIB-2017-084

This module enables you to integrate the Domain module with other popular Drupal modules. The Domain Integration Login Restrict sub-module enables you to restrict access to a domain based on the assigned domains on a user. The Domain Integration Login Restrict sub-module doesn't sufficiently chec...

MoneySuite - Moderately critical - Access bypass - SA-CONTRIB-2017-085

MoneySuite provides a set of modules for Drupal sites that rely on the sale of memberships and/or content for revenue. The modules have an access bypass vulnerability which allows untrusted users including anonymous users to view payments made by users within the system. No data can be modified,...

Denial Of Service (DoS)

Drupal is vulnerable to denial of service DoS attacks. The attacks are possible because the application does not limit the length of the path in the menu router, resulting in the generation of an IN query by Drupal\Core\Routing\RouteProvider, with the length growing exponentially with the number ...

Cross-site Scripting (XSS)

Drupal is vulnerable to cross-site scripting XSS attacks. When the quick edit module is enabled, a malicious user can inject and execute arbitrary Javascript through the Title field...

DRUPAL-CONTRIB-2017-083

Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form. When this module is in use, any user who is able to perform an action which rebuilds some of Drupal's caches can trigger a scenario in which certain pages protected by this...

DRUPAL-CONTRIB-2017-082

The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxonomy terms. The module grants access to nodes that are being blocked by other node access modules and that the Permissions by Term module does not intend to control. Additionally, ...

Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2017-082

The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxonomy terms. The module grants access to nodes that are being blocked by other node access modules and that the Permissions by Term module does not intend to control. Additionally, ...

Custom Permissions - Moderately critical - Access bypass - SA-CONTRIB-2017-083

Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form. When this module is in use, any user who is able to perform an action which rebuilds some of Drupal's caches can trigger a scenario in which certain pages protected by this...

Cross site scripting

Cross-site scripting XSS vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names...

CVE-2015-7878

Cross-site scripting XSS vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names...

CVE-2015-7878

CVE-2015-7878 affects the Drupal Taxonomy Find module (6.x-2.x up to 6.x-1.2; 7.x-2.x up to 7.x-1.0). Root cause: insufficient sanitization of taxonomy vocabulary/term names leads to cross-site scripting (XSS) via remote authenticated users with certain permissions. Impact: arbitrary web script/H...

CVE-2015-7878

Cross-site scripting XSS vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names...

Access Bypass

Drupal is vulnerable to access bypass. The entity access system does not prevent the unauthorized access to view, create, update, or delete entities without UUIDs, and entities with different access restrictions on different revisions of the same entity...

Access Bypass

Drupal is vulnerable to access bypass which allows attackers to see all views. This vulnerability occurs because the pages accessible by Ajax are not limited to the ones configured to be so. This allows attackers to use the filter parameter and the Ajax endpoint to view pages that they shouldn't ...

Access Bypass

Drupal is vulnerable to access bypass. Malicious users are able to leverage the REST API to post approved comments regardless of their permission level. This only affects applications which have the RESTful web services enabled...

Mosaik - Moderately critical - Cross-site scripting - SA-CONTRIB-2017-080

The Mosaik module enables you to create pages or complex blocks in Drupal with the logic of a real mosaic and its pieces. The module doesn't sufficiently sanitize the titles of fieldsets on its administration pages or the titles of blocks that it creates. This vulnerability is mitigated by the fa...