Drupal hosting module access rights bypass vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. hosting is one of the core modules of the Aegir hosting system. An access privilege bypass vulnerability exists in Drupal hosting module versions 7.x-3.x prior to 7.x-3.7. An attacker...

Drupal Panelizer Module Access Privilege Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Panelizer is one of the modules that applies Panels to any node or entity. An access privilege bypass vulnerability exists in the Drupal Panelizer module. An attacker could use this...

Drupal Panels Module Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Panels is one of the modules used by site administrators to create customized layouts for multiple users. A security bypass vulnerability exists in the Drupal Panels module. An attacker...

Drupal Google Analytics Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Google Analytics is one of the web traffic analysis modules. A cross-site scripting vulnerability in the Drupal Google Analytics module in versions 7.x-2.x prior to 7.x-2.3 and 8.x-2.x...

Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047

Panels does not check access on some routes Critical Panels allows users with certain permissions to modify the layout and panel panes on pages or entities utilizing panels. Much of the functionality to modify these panels rely on backend routes that call administrative forms. These forms did not...

Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046

The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any cust...

Drupal CODER Module Remote Code Execution

A code execution vulnerability exists in Drupal CODER Module. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

[SECURITY] Fedora 23 Update: drupal7-entity_translation-1.0-0.9.beta5.fc23

Allows fieldable entities to be translated into different languages, by introducing entity/field translation for the new translatable fields capability in Drupal 7. Maintained by the Drupal core i18n team. This project does not replace the Internationalization http://drupal.org/project/i18n...

[SECURITY] Fedora 24 Update: drupal7-entity_translation-1.0-0.9.beta5.fc24

Allows fieldable entities to be translated into different languages, by introducing entity/field translation for the new translatable fields capability in Drupal 7. Maintained by the Drupal core i18n team. This project does not replace the Internationalization http://drupal.org/project/i18n...

[SECURITY] Fedora 23 Update: drupal7-features-2.10-1.fc23

The features module enables the capture and management of features in Drupa l. A feature is a collection of Drupal entities which taken together satisfy a certain use-case. Features provides a UI and API for taking different site building components from modules with exportables and bundling them...

Fedora 23 : drupal7-features (2016-83189e6c2f)

7.x-2.10 - 7.x-2.9 - Denial of Service DoS - SA-CONTRIB-2016-020 - 7.x-2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

[SECURITY] Fedora 24 Update: drupal7-features-2.10-1.fc24

The features module enables the capture and management of features in Drupa l. A feature is a collection of Drupal entities which taken together satisfy a certain use-case. Features provides a UI and API for taking different site building components from modules with exportables and bundling them...

Piwik - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-043

This module enables you to add integration with Piwik statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is mitigated by the...

OAuth2 Client- Moderately Critical - Cross Site Request Forgery - SA-CONTRIB-2016-044

This module provides an OAuth2 client. The module does not check the validity of the state parameter, during server-side flow, before getting a token. This may allow a malicious user to feed a fake accesstoken to another user, and subsequently provide him fake data from the server. This page...

Require Login - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2016-045

This module enables you to restrict site access without using user roles or permissions. The module does not sufficiently escape some of its settings, and, in some cases, allows malicious users to bypass the protection offered by Require Login. CVE identifiers issued ACVE identifier will be...

Google Analytics - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-042

This module enables you to add integration with Google Analytics statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is...

Drupal v6. 22 /content/menucustom parameters menupereid SQL injection vulnerability

No description provided by source...

Administration Views - Critical - Access bypass - SA-CONTRIB-2016-041

Administration Views module replaces overview/listing pages with actual views for superior usability. The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to. CVE identifiers issued ACVE identifier...

Drupal Registration Codes Module Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Registration codes is one of the modules that provides users with a valid registration code when they register a new account on the site. A security bypass vulnerability exists in the...

Multiple vulnerabilities in Drupal Dropbox client module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Dropbox client is one of the modules used by Drupal users to interact with the Dropbox API. Cross-site scripting vulnerabilities and security bypass vulnerabilities in versions 7.x-3.x ...