Drupal Fixes Critical OpenID Bug

Drupal has patched several vulnerabilities in versions 6 and 7 of the content-management system, including a critical bug that enables an attacker to hijack administrators’ accounts and take arbitrary actions on target sites. That vulnerability lies in the OpenID module in Drupal that enables use...

Drupal Petition module cross-site scripting vulnerability (CNVD-2015-03892)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Petitions is one of the petition modules used in the U.S. White House website. A cross-site scripting vulnerability exists in the administration page of the Drupal Petitions module. A...

Drupal Releases Security Updates

Drupal has released updates to address multiple vulnerabilities. Exploitation of one of these vulnerabilities could allow a remote attacker to gain access to a system account, including an administrator's. Available updates include: • Drupal core 6.36 for 6.x users • Drupal core 7.38 for 7.x user...

Drupal EntityBulkDelete Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP.EntityBulkDelete is a module for bulk deletion of any type of entity. A cross-site scripting vulnerability exists in the Drupal EntityBulkDelete module, which allows remote attackers to exploit the vulnerability to inject...

Drupal Open Graph Importer Module Limit Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP. open Graph Importer is a module that supports back-end administrators or other users to import content from other websites using open graph meta tags. A security vulnerability exists in the Drupal Open Graph Importer module...

HTTP Strict Transport Security - Moderately Critical - Logical Error - SA-CONTRIB-2015-118

The contributed HSTS module makes it easy for site administrators to implement HTTP Strict Transport Security HSTS by setting the Strict-Transport-Security header on each page generated by Drupal. HSTS module provides a configuration UI for the HSTS "include subdomains" directive, which indicates...

Apache Solr Real-Time - Critical - Access Bypass - SA-CONTRIB-2015-119

This module allows content-changes to be committed to Apache Solr in real-time. The module doesn't check the status of an entity being indexed which means that unpublished content will get indexed by Solr and the title and partial content may be exposed to any user who has permission to search si...

Drupal User Import Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP.User Import is a module that provides the ability to import users. A cross-site request forgery vulnerability exists in the Drupal User Import module that allows remote attackers to construct malicious URIs, trick users...

Drupal Node Template Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP.Node Template is a module that uses the structure and data of nodes as a template. A cross-site request forgery vulnerability exists in the Drupal Node Template module that allows a remote attacker to construct a maliciou...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03861)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. A cross-site scripting vulnerability exists in the Drupal Webform module processing node header, which allows remote attackers to exploit the vulnerability to inject...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-002

Impersonation OpenID module - Drupal 6 and 7 - Critical A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts. This vulnerability is mitigated by the fact that the victim must have an...

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-123

The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack see SA-CORE-2015-002. Only sites with the Overlay module enabled are vulnerable. CVE identifiers issued...

Drupal Spider Contacts Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP.Spider Contacts is a contact component. A cross-site request forgery vulnerability exists in the Drupal Spider Contacts module that allows remote attackers to construct malicious URIs, trick users into parsing them, and can...

The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-121

The eXtensible Catalog Drupal Toolkit is a set of Drupal modules to harvest records of the XC Schema format from a Metadata Services Toolkit MST. The XC NCIP Provider module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause a user with "administer ncip providers"...

drupal -- multiple vulnerabilities

Drupal development team reports: Impersonation OpenID module - Drupal 6 and 7 - Critical A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts. This vulnerability is mitigated by the fa...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03860)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. The Drupal Webform module handles view-based webform result forms with a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to...

Drupal Password Policy Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP.Password Policy is a module that provides more advanced password complexity detection capabilities. The Drupal Password Policy module has a cross-site scripting vulnerability when a website uses a username constraint policy ...

Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126

The Content Construction Kit CCK project is a set of modules that allows you to add custom fields to nodes using a web browser. CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain...

Administration Views - Moderately Critical - Access Bypass - SA-CONTRIB-2015-122

This module replaces administrative overview/listing pages with Views for improved usability. When combined with other contributed or custom modules, the Administration Views module improperly grants users access to administration pages including the permissions page. This vulnerability is...

Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120

The Inline Entity Form module provides a field widget for inline management creation, modification, removal of referenced entities. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that ...