CVE-2016-6212

The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors...

UBUNTU-CVE-2016-6211

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form...

CVE-2016-6211

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form...

CVE-2016-6212

The CVE-2016-6212 entry concerns Drupal’s Views module (7.x-3.x before 7.x-3.14 and 8.x before 8.1.3) where remote authenticated users could bypass normal access restrictions and obtain sensitive Statistics information via unspecified vectors. The vulnerability arises in the Views module’s handli...

CVE-2016-6211

Summary: CVE-2016-6211 affects Drupal 7.x up to 7.44 in the User module. Vulnerability: remote authenticated users can gain privileges by triggering a rebuild of the user profile form via contributed/custom code. Impact: privilege escalation as described in multiple sources. Evidence: references ...

CVE-2016-6212

The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors...

CVE-2016-6211

Removed by vendor...

Drupal Flag Lists Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Flag Lists is one of the modules that allows users to create tagged lists. A cross-site scripting vulnerability exists in the Drupal Flag Lists module. The program fails to adequately...

Flag Lists - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-051

This module enables regular users to create unlimited private flags called lists. The flaglists module doesn't sufficiently filter the output when applying token strings to flaglists links leading to a persistent Cross Site Scripting XSS attack. This vulnerability is mitigated by the fact that an...

Drupal Flag Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in the Drupal Flag module, which allows attackers to bypass security restrictions and perform unauthorized operations...

Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050

Flag enables users to mark content with any number of admin-defined flags, such as 'bookmarks' or 'spam'. Flag Bookmark is a submodule within Flag, which provides a 'bookmarks' flag, and default views to list bookmarked content. The provided view that lists each user's bookmarked content as a tab...

Drupal Instagram Block Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in the Drupal Instagram Block module, which allows attackers to exploit the vulnerability to obtain sensitive information...

Drupal Workbench Scheduler Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in the Drupal Workbench Scheduler module, which could be exploited by an attacker to bypass certain security restrictions and perfor...

Drupal RESTWS Module Page Callback Remote Code Execution

A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted HTTP request to the target server. Successful exploitation could allow the attacker to execute arbitrary code in the context of the web server process...

Workbench Scheduler - Moderately Critical - Access Bypass - SA-CONTRIB-2016-049

Workbench Scheduler module provides users with the ability to create schedules that change moderated content from one workbench moderation state to another. An authenticated user could add a schedule to a node even when that content type has schedules disabled. The vulnerability is mitigated by t...

Drupal Require Login Module Access Privilege Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Require Login is one of the plugins that redirects users to the login page. An access privilege bypass vulnerability exists in the Drupal Require Login module in versions 7.x-2.x prior ...

Drupal Piwik Web Analytics Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Piwik Web Analytics is one of the Piwik web traffic analysis modules. A cross-site scripting vulnerability exists in the Drupal Piwik Web Analytics module in versions 7.x-2.x prior to...

Drupal OAuth2 Client Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OAuth2 Client is one of the client modules used to connect to the OAuth2 server. A cross-site request forgery vulnerability exists in Drupal OAuth2 Client module versions prior to...

Drupal coder module presence unauthenticated remote code execution vulnerability-vulnerability warning-the black bar safety net

! In a review of the coder module secure code when I'm on Drupal Security Advisory SA-CONTRIB-2 0 1 6 years-0 3 9 found that an unauthenticated remote code execution vulnerability. The vulnerability affects Drupal coder module version including 7. the x - 1.3 and 7. x -2.6 all of the following...

Drupal Coder Module coder_upgrade.run.php Remote Code Execution

The vulnerability is due to improper input validation on user-supplied input. remote, unauthenticated attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation could allow the attacker to execute arbitrary code in the context of the proces...