14379 matches found
CVE-2016-9450
Removed by vendor...
CVE-2016-9450
Drupal core prior to 8.2.3 is affected by CVE-2016-9450 due to an incorrect cache context on the user password reset page, enabling cache-poisoning and potential content spoofing. The issue is fixed in Drupal 8.2.3 (upstream patch). Affected product: Drupal core (Drupal 8.x); root cause: failure ...
CVE-2016-9452
CVE-2016-9452 affects Drupal Core via the transliterate mechanism in Drupal 8.x (pre-8.2.3). A specially crafted URL can cause a denial of service, potentially stopping the application. Affected product: Drupal Core 8.x before 8.2.3. Root cause: issue in transliterate handling that can be trigger...
CVE-2016-9452
The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...
CVE-2016-9451
CVE-2016-9451 affects Drupal Core (Drupal 7.x) up to version 7.52. Root cause: a flaw in Confirmation forms that enables a remote authenticated user to perform open redirects via specially crafted URLs, potentially enabling phishing. Impact: open redirect to arbitrary sites; exploited by authenti...
CVE-2016-9451
Removed by vendor...
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9449
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...
CVE-2016-9449
Removed by vendor...
Drupal Core Phishing Attack Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Core in versions 7.x prior to Drupal 7.52 and 8.x prior to 8.2.3. An attacker can exploit this vulnerability by constructing a malicious...
Drupal 7.x < 7.52 / 8.x < 8.2.3 Multiple Vulnerabilities
The version of Drupal running on the remote web server is 7.x prior to 7.52 or 8.x prior to 8.2.3. It is, therefore, affected by the multiple vulnerabilities : - An information disclosure vulnerability exists in the taxonomy module when using access query tags that are inconsistent with the...
DLA-715-1 drupal7 - security update
Bulletin has no description...
[ASA-201611-20] drupal: multiple issues
Arch Linux Security Advisory ASA-201611-20 ========================================== Severity: Medium Date : 2016-11-19 CVE-ID : CVE-2016-9449 CVE-2016-9450 CVE-2016-9452 Package : drupal Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The...
Drupal Fixes 'Moderately Critical' Vulnerabilities in Core Engine
The Drupal Security Team fixed a handful of issues in version 7 and 8 of its content management system core engine this week that could have led to cache poisoning, social engineering attacks and a denial of service condition. Drupal SA-CORE-2016-005 – Moderately Critical Update to Drupal core 7....
Drupal Core Denial of Service Vulnerability (CNVD-2016-11384)
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A denial-of-service vulnerability exists in Drupal Core, which can be exploited by attackers to cause a denial-of-service attack...
Drupal Core Security Bypass Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in Drupal Core, which can be exploited by attackers to bypass security restrictions and perform unauthorized operations...
Drupal Core Information Disclosure Vulnerability (CNVD-2016-11385)
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in Drupal Core, which can be exploited by attackers to obtain sensitive information...
DSA-3718-1 drupal7 - security update
Bulletin has no description...
