1020 matches found
CVE-2017-9200
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63...
Scheduler Workbench Integration - Critical - Unsupported - SA-CONTRIB-2017-39
Updates 20170414 - A new module maintainer has been found and a new release for this module has been published. Provides integration between the Scheduler module and the Workbench Moderation module. The security team is marking this module unsupported. There is a known security issue with the...
Storage API stream wrappers - Moderately Critical - Access bypass - SA-CONTRIB-2017-010
This module provides stream wrappers to integrate Storage API with Drupal, as an alternative to Storage API's corebridge submodule. It provides two stream wrappers: "Storage API Public" and "Storage API Private". The private storage API doesn't sufficiently performs access control allowing...
[SECURITY] [DSA 3738-1] tomcat7 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3738-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 18, 2016 https://www.debian.org/security/faq -...
Downloads Resources over HTTP
Overview Affected versions of haxe-dev insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...
Debian DLA-492-1 : pdns security update
It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected. For Debian 7 'Wheezy', these problems have been fixed in version 3.1-4.1+deb7u1. Note that if you're running the pdns server with the mysql...
DLA-492-1 pdns - security update
Bulletin has no description...
Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019
This module enables you to build an online store that uses nodes to display products through the use of product reference fields. The default widget for those fields is an autocomplete textfield similar to the taxonomy term reference field's autocomplete widget. As you type in the textfield, the...
Fast Autocomplete - Critical - DOS vulnerability - SA-CONTRIB-2016-016
This module enables you to show IMDB-like suggestions when entering terms into an input field using json files to "cache" suggestions making the autocomplete very fast. The module doesn't sufficiently validate the incoming language parameter in the request path when a json file of the module is...
Encrypt - Moderately Critical - Weak Encryption - SA-CONTRIB-2015-166
This module enables you to encrypt data within Drupal using a user-configurable encryption method and key provider. The module did not sufficiently validate good configurations and api usage resulting in multiple potential weaknesses depending on module usage. The default encryption method could...
Entity Registration - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-155
This module enables you to manage registrations for events. The module doesn't sufficiently protect information about who is registered to attend specific events when anonymous users are granted a permission that is commonly recommended when allowing anonymous registrations. This vulnerability is...
CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150
CMS Updater allows to update Drupal core automatically with a subscription service. Access bypass The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. This vulnerability is mitigated by the fact that an...
Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148
Drupal 7 driver for SQL Server and SQL Azure module has a SQL injection vulnerability. Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. Only sites that use contrib or cust...
Fedora 22 : drupal6-ctools-1.14-1.fc22 (2015-14331)
See Ctools - Critical - Multiple Vulnerabilities - SA- CONTRIB-2015-141. This is an incremental security and bugfix release for ctools. Looking to fix future D6 CTools issues? Find japerry or merlinofchaos in drupal-scotch, drupal- contribute, or drupal-panels -- and become a maintainer for D6...
Ctools - Critical - Multiple Vulnerabilities - SA-CONTRIB-2015-141
Cross Site Scripting XSS Ctools in Drupal 6 provides a number of APIs and extensions for Drupal, and is a dependency for many of the most popular modules, including Views, Panels and Entityreference. Many features introduced in Drupal Core once lived in ctools. This vulnerability can be mitigated...
[SECURITY] Fedora 22 Update: devscripts-2.15.8-1.fc22
Scripts to make the life of a Debian Package maintainer easier...
Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136
This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...
Why Tor Shuts Down its Anonymous Cloud Service?
Why Tor Cloud Project Shuts Down? Yes, you heard that right. The Tor project has announced that it’s closing down its Tor Cloud service that allowed users to donate bandwidth for browsing the web anonymously. The Tor Project is a non-profit organization behind the Tor anonymizing network that...
Management: Limited RBAC authorization bypass
It was discovered that the Role Based Access Control RBAC implementation did not sufficiently verify all authorization conditions that are required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role could use this flaw to add, modify, ...