SA-CONTRIB-2013-089 - Node Access Keys - Access Bypass

Node Access Keys helps to grant users temporary view permissions to selected content types on a per user role basis. However, it only implements hooknodeaccess and not hookqueryalter, which means any listing of nodes does not respect the node view access. CVE identifiers issued CVE-2013-4596...

CVE-2013-5965

The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hookqueryalter function, which might allow remote attackers to obtain sensitive information by reading a node listing...

CVE-2013-5965

CVE-2013-5965 : The Drupal module Node View Permissions (7.x-1.x) before 7.x-1.2 does not properly implement hook_query_alter, which may allow remote attackers to read a node listing and obtain sensitive information. Affected product: Drupal module Node View Permissions (7.x-1.x series). Root cau...