Views - Moderately Critical - Access Bypass - SA-CONTRIB-2017-022

The Views module allows site builders to create listings of various data in the Drupal database. The Views module fails to add the required query tags to listings of Taxonomy Terms, which could cause private data stored on Taxonomy Terms to be leaked to users without permision to view it. This is...

UBUNTU-CVE-2017-5610

wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms...

Permissions by Term -- Critical - Multiple vulnerabilities - SA-CONTRIB-2017-001

The Permissions by Term module extends Drupal functionality by restricting access to single nodes via taxonomy terms. Taxonomy terms are part of the Drupal core functionality. Taxonomy term permissions can be coupled to specific user accounts and/or user roles. Enabling the module unintentionally...

UBUNTU-CVE-2016-9449

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...

Lepton terms parameter SQL injection vulnerability

Lepton is a set of tools for lossless compression of JPEG format files. A SQL injection vulnerability exists in the Lepton terms parameter, which could allow an attacker to take control of the application, access or modify data, or exploit a potential vulnerability in the underlying database...

Drupal Fixes 'Moderately Critical' Vulnerabilities in Core Engine

The Drupal Security Team fixed a handful of issues in version 7 and 8 of its content management system core engine this week that could have led to cache poisoning, social engineering attacks and a denial of service condition. Drupal SA-CORE-2016-005 – Moderately Critical Update to Drupal core 7....

WhatsApp Blasted by EU Data Protection Group Over Facebook Sharing

Yet another privacy coalition is urging WhatsApp to clarify that user information shared between the company and Facebook is compliant with data protection laws on the books in Europe. The Article 29 Working Party, comprised of representatives from data protection authorities from each EU member...

Threat Outbreak Alert RuleID24353: Email Messages Distributing Malicious Software on August 18, 2016

Medium Alert ID: 48517 First Published: 2016 August 18 14:25 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24353 may contain the following files: Name |...

Fedora 24 : drupal7-views (2016-fff25f75b4)

Fixes Views - Less Critical - Access Bypass - SA-CONTRIB-2016-036 Changes since 7.x-3.13 : - Adding field handlers for statistics fields - \2200309 by helmo: Changed invalid placeholder from 'handler' to 'extender'. - \2708535 by stefan.r: Allow users to sort on a specific language, showing it...

MS16-088: Description of the security update for SharePoint Server 2016: July 12, 2016

None None...

Medical Terms DE - Dynamic Code Loading, External URLs, SQLite database found vulnerabilities

HackApp vulnerability scanner discovered that application Medical Terms DE published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID17651: Email Messages Distributing Malicious Software on August 28, 2015

Medium Alert ID: 40729 First Published: 2015 August 31 13:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17651 may contain the following files: Name |...

CVE-2015-4370

Cross-site scripting XSS vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4365

Cross-site scripting XSS vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4358

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with permission to create or edit taxonomy terms or nodes to inject arbitrary web script or HTML via...

Cross site scripting

Cross-site scripting XSS vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

Cross site scripting

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4370

Cross-site scripting XSS vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4370

CVE-2015-4370 is a XSS in the Drupal Site Documentation module (6.x-1.x) prior to 6.x-1.5. Root cause: insufficient sanitization of user-supplied text on certain pages, exploitable by remote authenticated users with permission to create/edit taxonomy terms. Impact: arbitrary script/HTML injection...