CVE-2016-3165

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "access" set to FALSE in the server-side form definition...

CVE-2016-3170

Removed by vendor...

CVE-2016-3171

Removed by vendor...

CVE-2016-3165

Removed by vendor...

CVE-2016-3165

The issue CVE-2016-3165 affects Drupal 6.x before 6.38 where the Form API fails to enforce access restrictions on submit buttons. The server-side form definition may mark a button as #access = FALSE, yet a form submission can still be accepted if the attacker has permission to submit the form, ef...

CVE-2016-3169

CVE-2016-3169 affects the Drupal core User module: Drupal 6.x versions before 6.38 and 7.x versions before 7.43 are vulnerable. The root cause is code paths that call user_save with an explicit category and load all roles into the roles array, enabling remote privilege escalation. Impact: attacke...

CVE-2016-3169

The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the usersave function with an explicit category and loads all roles into the array...

CVE-2016-3170

Drupal Core CVE-2016-3170 affects Drupal 7.x before 7.43 and Drupal 8.x before 8.0.4. The issue arises when a configuration allows login by email and a module permits logging in, enabling remote attackers to disclose usernames via the Forgot Password workflow. The vulnerability is confirmed by NV...

CVE-2016-3169

Removed by vendor...

CVE-2016-3164

Removed by vendor...

CVE-2016-3162

The CVE-2016-3162 issue affects Drupal's File module (Drupal 7.x before 7.43 and 8.x before 8.0.4). The root cause is an access-control bypass that lets remote authenticated users who can create content or upload files read, delete, or substitute a link to a file uploaded to an unprocessed form. ...

CVE-2016-3162

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...

CVE-2016-3168

The CVE-2016-3168 issue affects Drupal: System module in Drupal 6.x prior to 6.38 and 7.x prior to 7.43 is vulnerable to a reflected file download that can allow remote attackers to hijack the authentication of site administrators when downloading and executing files containing arbitrary JSON-enc...

CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...

CVE-2016-3171

Drupal 6.x before 6.38 is vulnerable when used with PHP < 5.4.45, 5.5.x < 5.5.29, or 5.6.x

CVE-2016-3171

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation...

CVE-2016-3166

CVE-2016-3166 describes a CRLF injection in Drupal 6.x before 6.38 when used with PHP before 5.1.2, due to the drupal_set_header function. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting by leveraging a module that outputs user-submitted data...

CVE-2016-3167

CVE-2016-3167 concerns Drupal 6.x prior to 6.38 where the open redirect is caused in the core function drupal_goto . When used with PHP before 5.4.7, a double-encoded value in the destination parameter enables remote attackers to redirect users to arbitrary external sites, facilitating phishing-s...

CVE-2016-3164

CVE-2016-3164 affects Drupal core: Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4. The issue is an open redirect caused by path manipulation, able to be triggered via custom code or a form shown on a 404 page. Impact is remote exploitation leading to redirection to arbitrary sites....

CVE-2016-3163

CVE-2016-3163 affects the Drupal core XML-RPC subsystem. Drupal 6.x prior to 6.38 and 7.x prior to 7.43 allows remote attackers to perform brute‑force attacks by issuing a large number of calls to the same XML-RPC method, potentially aiding password guessing. Mitigation in public advisories: appl...