14281 matches found
Denial of service via transliterate mechanism
More info at https://www.drupal.org/SA-CORE-2016-005...
Inconsistent name for term access query
More info at https://www.drupal.org/SA-CORE-2016-005...
Incorrect cache context on password reset page
More info at https://www.drupal.org/SA-CORE-2016-005...
Inconsistent name for term access query
More info at https://www.drupal.org/SA-CORE-2016-005...
Denial of service via transliterate mechanism
More info at https://www.drupal.org/SA-CORE-2016-005...
Drupal Code -- Multiple Vulnerabilities
The Drupal development team reports: Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by...
Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005
Description Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing...
Drupal D8 Editor File upload module cross-site scripting vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.File is one of the file handling modules. A cross-site scripting vulnerability exists in the Drupal D8 Editor File upload module that stems from a failure to properly validate user inpu...
Drupal Workbench Moderation Module Information Disclosure Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.The Workbench Moderation module enables you to customize the editorial workflow in your website. An information disclosure vulnerability exists in the Drupal Workbench Moderation module...
Drupal Views Send Module Cross-Site Scripting Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. View sending enables you to send emails to multiple users from a single view. A cross-site scripting vulnerability exists in the Drupal Views Send module due to the program failing to...
Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061
The Views Send module enables you to send mail to multiple users from a View. The module doesn't sufficiently filter potential user-supplied data when previewing the e-mail which can lead to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker mus...
Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055
This module enables users to create menu items that render views instead of links. This is useful for creating "mega-menus". The module doesn't sufficiently filter title and breadcrumb fields for possible cross-site scripting. This vulnerability is mitigated by the fact that an attacker must have...
Bootstrap - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-058
The Bootstrap theme enables you to integrate the Bootstrap framework with Drupal. The theme does not sufficiently filter potential user-supplied data when it's passed to certain templates can which lead to a Persistent Cross Site Scripting XSS vulnerability. CVE identifiers issued ACVE identifier...
Drupal Tripal BLAST UI Module Remote Code Execution Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal Tripal BLAST UI module, which can be exploited by an attacker to execute arbitrary code in the context of an...
Workbench Moderation - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-060
This module enables you to create and manage custom editorial workflows around a site's content. The module could result in unpublished content being temporarily made visible via content lists, e.g. as generated by Views, when its editorial status was being changed, e.g. from "draft" to "needs...
Like/Dislike - Critical - Cross Site Request Forgery - SA-CONTRIB-2016-056
Cross Site Request Forgery Like/Dislike module can be used to Like and Dislike actions on any content. It is powered by Drupal field concept. The module does not verify user intent on like/dislike links thereby exposing a Cross Site Request Forgery CSRF vulnerability. CVE identifiers issued ACVE...
D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059
This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...
Drupal 7.x < 7.19 Multiple Vulnerabilities
Binary data 9725.prm...