14426 matches found
CVE-2016-3166
CRLF injection vulnerability in the drupalsetheader function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP...
CVE-2016-3162
Removed by vendor...
CVE-2016-3167
Removed by vendor...
CVE-2016-3166
Removed by vendor...
CVE-2016-3168
Removed by vendor...
CVE-2016-3163
Removed by vendor...
CVE-2016-3188
The prepopulaterequestwalk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the 1 actions, 2 container, 3 token, 4 password, 5 passwordconfirm, 6 textformat, or 7 markup field type, and consequently have unspecified impact, via unspecified...
CVE-2016-3188
The prepopulaterequestwalk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the 1 actions, 2 container, 3 token, 4 password, 5 passwordconfirm, 6 textformat, or 7 markup field type, and consequently have unspecified impact, via unspecified...
CVE-2016-3187
The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter...
CVE-2016-3187
The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter...
Cross site request forgery (csrf)
The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter...
Code injection
The prepopulaterequestwalk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the 1 actions, 2 container, 3 token, 4 password, 5 passwordconfirm, 6 textformat, or 7 markup field type, and consequently have unspecified impact, via unspecified...
CVE-2016-3188
The prepopulaterequestwalk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the 1 actions, 2 container, 3 token, 4 password, 5 passwordconfirm, 6 textformat, or 7 markup field type, and consequently have unspecified impact, via unspecified...
CVE-2016-3188
The CVE-2016-3188 entry concerns Drupal’s Prepopulate module (7.x-2.x before 7.x-2.1). The flaw arises from the module failing to restrict users from overwriting arbitrary parts of $_REQUEST, enabling manipulation of fields such as actions, container, token, password, password_confirm, text_forma...
CVE-2016-3187
The CVE-2016-3187 issue affects the Drupal Prepopulate module (7.x-2.x) prior to 7.x-2.1. An attacker can modify the REQUEST superglobal via a base64-encoded pp parameter, with unspecified impact. The vulnerability is addressed by upgrading to Prepopulate 7.x-2.1 (DRUPAL-SA-CONTRIB-2016-009). Exp...
Drupal 6.x Detection
Binary data 9210.prm...
Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities
Binary data 9213.prm...
Drupal 7.x < 7.41 Overlay Module Open Redirect
Binary data 9219.prm...