786 matches found
DRUPAL-CONTRIB-2017-082
The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxonomy terms. The module grants access to nodes that are being blocked by other node access modules and that the Permissions by Term module does not intend to control. Additionally, ...
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet...
Threat Outbreak Alert RuleID30637: Email Messages Distributing Malicious Software on September 18, 2017
Medium Alert ID: 55318 First Published: 2017 September 18 14:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30637 may contain the following files: Name ...
Extending the Microsoft Office Bounty Program
Microsoft announces the extension of the Microsoft Office Bounty Program through December 31, 2017. This extension is retroactive for any cases submitted during the interim. The engagement we have had with the security community has been great and we are looking to continue that collaboration on...
Legal Robot: Failed OutLink on Terms of Service
Hi team .. i found Failed OutLink on Terms of Service on https://www.legalrobot-uat.com/faq/ when i open it i read some your service it show me page 404: Page Not Found with this Link .. https://www.legalrobot-uat.com/faq/"/terms" please check really Link On your website...
Information Disclosure
Drupal is vulnerable to information disclosure. If an application restricted access to taxonomy terms but did not look for both termaccess and taxonomytermaccess, authenticated attackers would have been able to access sensitive information on taxonomy terms...
Threat Outbreak Alert RuleID29345: Email Messages Distributing Malicious Software on May 31, 2017
Medium Alert ID: 54001 First Published: 2017 May 31 17:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29345 may contain the following files: Name | Size...
BWT EP5 - It Has Been 0-days Since This Term was Abused
Beers with Talos Episode 5 "It Has Been 0-days Since This Term was Abused" is now availableListen here:Listen via iTunesListen directly on the Talos Podcasts page.Episode Notes:The crew talks about the potential of Samba echoing WannaCry and blocking SMB ports but you already did that, RIGHT?. We...
Legal - Critical - Unsupported - SA-CONTRIB-2017-36
Update: 2017-06-04 The issue in this module has been fixed and a new release has been made Displays your Terms & Conditions to users who want to register, and requires that they accept the T&C before their registration is accepted. The security team is marking this module unsupported. There is a...
WordPress 4.7-4.7.2 - Cross-Site Scripting (XSS) via Taxonomy Term Names
...
Views - Moderately Critical - Access Bypass - SA-CONTRIB-2017-022
The Views module allows site builders to create listings of various data in the Drupal database. The Views module fails to add the required query tags to listings of Taxonomy Terms, which could cause private data stored on Taxonomy Terms to be leaked to users without permision to view it. This is...
UBUNTU-CVE-2017-5610
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms...
Permissions by Term -- Critical - Multiple vulnerabilities - SA-CONTRIB-2017-001
The Permissions by Term module extends Drupal functionality by restricting access to single nodes via taxonomy terms. Taxonomy terms are part of the Drupal core functionality. Taxonomy term permissions can be coupled to specific user accounts and/or user roles. Enabling the module unintentionally...
UBUNTU-CVE-2016-9449
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags...
Lepton terms parameter SQL injection vulnerability
Lepton is a set of tools for lossless compression of JPEG format files. A SQL injection vulnerability exists in the Lepton terms parameter, which could allow an attacker to take control of the application, access or modify data, or exploit a potential vulnerability in the underlying database...
Drupal Fixes 'Moderately Critical' Vulnerabilities in Core Engine
The Drupal Security Team fixed a handful of issues in version 7 and 8 of its content management system core engine this week that could have led to cache poisoning, social engineering attacks and a denial of service condition. Drupal SA-CORE-2016-005 – Moderately Critical Update to Drupal core 7....
WhatsApp Blasted by EU Data Protection Group Over Facebook Sharing
Yet another privacy coalition is urging WhatsApp to clarify that user information shared between the company and Facebook is compliant with data protection laws on the books in Europe. The Article 29 Working Party, comprised of representatives from data protection authorities from each EU member...
Threat Outbreak Alert RuleID24353: Email Messages Distributing Malicious Software on August 18, 2016
Medium Alert ID: 48517 First Published: 2016 August 18 14:25 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24353 may contain the following files: Name |...
Fedora 24 : drupal7-views (2016-fff25f75b4)
Fixes Views - Less Critical - Access Bypass - SA-CONTRIB-2016-036 Changes since 7.x-3.13 : - Adding field handlers for statistics fields - \2200309 by helmo: Changed invalid placeholder from 'handler' to 'extender'. - \2708535 by stefan.r: Allow users to sort on a specific language, showing it...
