4341 matches found
Breakpoint Panels - Critical - Unsupported - SA-CONTRIB-2017-028
Breakpoint panels adds a button to the Panels In-Place Editor for each pane. When selected, it will display checkboxes next to all of the breakpoints specified in that modules UI. Unchecking any of these will 'hide' it from that breakpoint. The security team is marking this module unsupported...
RestWS - Moderately Critical - Information Disclosure - SA-CONTRIB-2017-024
RestWS makes Drupal Entity data available in a REST API. The module doesn’t sufficiently check for access to properties when filtering queries. This vulnerability is mitigated by the fact that an attacker must have a role that allows them to access an entity type with access-controlled properties...
Authentication Bypass in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-002/...
Cisco Unified Communications Manager Web Interface Cross-Site Scripting Vulnerability (cisco-sa-20170215-ucm)
A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected software. Copyright C 2017 Greenbone Networks GmbH Some text descriptions...
Flag clear - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2017-017
The Flag clear module allows administrators to remove user flags for content. This functionality is often useful in user-submission use-cases, where users do not necessarily need to unflag things on their own. The module doesn't sufficiently protect from CSRF attacks. The unflagging links do not...
Hotjar - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-015
This module enables you to add the Hotjar tracking system to your website. The module doesn't sufficiently sanitize the Hotjar ID when including tracking code. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer hotjar". CVE identifiers...
Wetkit Omega - Moderately Critical - Access Bypass - SA-CONTRIB-2017-012
WetKit Omega 4.x is a modern, Sass and Compass enabled Drupal 7 theme powered by the Omega base theme. When using the Drupal page cache, some links intended for privileged users can get cached and displayed to users who shouldn't have access to them. This is mitigated by the fact that the...
OSF for Drupal - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-014
This module enables administrators to use a user interface to create complex semantic queries that can be saved to be used in different locations of a Drupal instance that uses OSF. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Securi...
Facebook Pull - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-011
This module enables you to add integration with Facebook API. The module doesn't sufficiently sanitize incoming data from Facebook. This vulnerability is mitigated by the fact that an attacker must have be able to successfully pass malicious code through Facebook API or alter facebooks DNS and...
SalesCloud - Critical - Unsupported - SA-CONTRIB-2017-008
This module Connects Drupal to SalesCloud's API, a Commerce Platform as a Service. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes. Versions affected All versions Drupal core is not affected. If you do not use th...
Cisco WebEx Extension for Chrome RCE (cisco-sa-20170124-webex)
The Cisco WebEx Extension for Chrome installed on the remote host is affected by a remote code execution vulnerability due to a crafted pattern that permits any URL utilizing it to automatically use native messaging to access sensitive functionality provided by the extension. An unauthenticated,...
GnuTLS -- Memory corruption vulnerabilities
The GnuTLS project reports: It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows. GNUTLS-SA-2017-2 It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted X.509 certificat...
Permissions by Term -- Critical - Multiple vulnerabilities - SA-CONTRIB-2017-001
The Permissions by Term module extends Drupal functionality by restricting access to single nodes via taxonomy terms. Taxonomy terms are part of the Drupal core functionality. Taxonomy term permissions can be coupled to specific user accounts and/or user roles. Enabling the module unintentionally...
Cisco IOS XR Software HTTP 2.0 Request Handling Event Service Daemon Denial of Service Vulnerability (cisco-sa-20161207-ios-xr)
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash, resulting in a denial of service DoS condition. Copyright C 2016 Greenbone Networks GmbH Some text description...
High-performance JavaScript callback handler - Highly Critical - Multiple vulnerabilities - SA-CONTRIB-2016-063
The High-performance JavaScript callback handler module is a light weight callback to bypass most, if not all, of Drupal's bootstrapping process to achieve improved performance. The module does not sufficiently check whether or not a callback is being properly accessed or filtering for potential...
Cisco Unified Communications Manager 7/8/9 - Directory Traversal
Exploit Title: Cisco Unified Communications Manager Administrative Web Interface Directory traversal CVE-2013-5528 Date: 7th December 2016 Exploit Author: justpentest Vendor Homepage: https://software.cisco.com/ Software Link: https://software.cisco.com/download/navigator.html?mdfid=268439621...
Fedora 25 : drupal8 (2016-411f8b961e)
8.2.3 Release Notes - Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...
DSA-3718-1 drupal7 - security update
Bulletin has no description...
Apple Xcode < 8.1 Node.js Multiple RCE (macOS)
The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a...