Drupal Core Open Redirect Vulnerability

Drupal is a free and open source content management system developed in PHP. An open redirection vulnerability exists in Drupal Core. An attacker is allowed to exploit the vulnerability to handle certain redirection paths...

Drupal Core Information Disclosure Vulnerability (CNVD-2016-01932)

Drupal is a free and open source content management system developed in PHP. Drupal Core has a security vulnerability. Depending on the data that has been added to the form or saved before the array, allows an attacker can lead to a user to get all the roles on the site...

Fedora 24 : drupal6-emfield-2.7-1.fc24 (2016-f0bb0dad51)

6.x-2.7 Fixes Embedded Media Field - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2016-004 Changes since 6.x-2.6: by dalin: Ensure that width and height are always numbers. \1868588 by tangent: URL detection regex does not match hyphens / breaks HTML markup Note that Tenable Network...

[SECURITY] Fedora 24 Update: drupal6-emfield-2.7-1.fc24

This extensible module will create fields for content types that can be use d to display video, image, and audio files from various third party providers. W hen entering the content, the user will simply paste the URL or embed code from the third party, and the module will automatically determine...

Login one time - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-017

The Login one time module provides the ability to email one-time login links to users. The module doesn't sufficiently sanitize user input supplied to an ajax callback function. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security...

[SECURITY] Fedora 23 Update: drupal6-emfield-2.7-1.fc23

This extensible module will create fields for content types that can be use d to display video, image, and audio files from various third party providers. W hen entering the content, the user will simply paste the URL or embed code from the third party, and the module will automatically determine...

[SECURITY] Fedora 22 Update: drupal6-emfield-2.7-1.fc22

This extensible module will create fields for content types that can be use d to display video, image, and audio files from various third party providers. W hen entering the content, the user will simply paste the URL or embed code from the third party, and the module will automatically determine...

Drupal Prepopulate module security bypass vulnerability (CNVD-2016-01737)

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. prepopulate is one of the prepopulated field modules. A security vulnerability exists in Drupal Prepopulate due to the program's failure to restrict users from overriding any portion o...

Drupal Prepopulate Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. prepopulate is one of the prepopulated field modules. Drupal Prepopulate has a security vulnerability due to a failure to restrict users from overriding any portion of $REQUEST and...

Fast Autocomplete - Critical - DOS vulnerability - SA-CONTRIB-2016-016

This module enables you to show IMDB-like suggestions when entering terms into an input field using json files to "cache" suggestions making the autocomplete very fast. The module doesn't sufficiently validate the incoming language parameter in the request path when a json file of the module is...

Drupal Multiple Vulnerabilities (Mar 2016) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Multiple Vulnerabilities (Mar 2016) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal cross-site scripting vulnerability (CNVD-2016-01562)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal that could be exploited by an attacker to steal cookie-based authentication credentials and execute arbitrary script...

[SECURITY] Fedora 23 Update: drupal7-7.43-1.fc23

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Scald File - Critical - Remote Code Execution - SA-CONTRIB-2016-015

When a PDF is uploaded in Scald File, various tools can be executed if they're installed on the server, to try to generate a thumbnail out of that PDF. This is mitigated by the need to have the sufficient permissions to upload a file in Scald, and also to have at least one of the thumbnail creati...

[SECURITY] Fedora 22 Update: drupal6-6.38-1.fc22

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 23 Update: drupal6-6.38-1.fc23

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Drupal 7.x < 7.43 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 7.x prior to 7.43. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the File module that allows an attacker to view, delete, or substitute a link to a file that has not yet been submitted or processed by a...

Drupal Unsupported Version Detection (deprecated)

This plugin has been deprecated. For plugins which identify unsupported instances of this product, search the plugin feed for Drupal SEoL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid89684; scriptversion"1.8";...

Fedora 22 : drupal7-active_tags-2.0-0.9.alpha1.fc22 (2015-4b2e639bb6)

Issue 2288251 by pfrenssen, SylvainM: Fix XSS vulnerability when rendering tags. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...