Drupal Views Refresh Refresh Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Views Refresh Refresh module. This allows an attacker to bypass certain security restrictions and perform unauthorized...

Drupal Views Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Views module. The vulnerability allows attackers to bypass certain security restrictions and perform unauthorized...

Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...

Drupal Views access bypass vulnerability (CNVD-2017-221665)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views is one of the view components. An access bypass vulnerability exists in Drupal Views versions prior to 7.x-3.17. An attacker can exploit this vulnerability to bypass security...

Drupal Views Refresh Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views Refresh is one of the page view refresh modules. A security bypass vulnerability exists in Drupal Views Refresh versions prior to 7.x-1.2. A remote attacker can exploit this...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)

Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

Drupal Patches Critical Access Bypass Bug

Website management platform Drupal released several patches that address access bypass vulnerabilities in its Drupal 8 Core engine Wednesday, fixing one critical and two moderately critical security bugs. The most serious of the vulnerabilities is the access bypass vulnerability CVE-2017-6925 in...

Drupal Views Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views is one of the view components. An access bypass vulnerability exists in version 8.x of Drupal Views prior to 8.3.7. An attacker could use this vulnerability to bypass security...

Views does not properly restrict access to the Ajax endpoint.

More info at https://www.drupal.org/SA-CORE-2017-004...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team: CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

Phamm 'login_form' function cross-site scripting vulnerability

Phamm is a PHP-based web hosting manager that supports multiple roles with access rights to manage virtual services using an LDAP backend. A cross-site scripting vulnerability exists in the 'loginform' function of the views/helpers.php file in versions of Phamm prior to 0.6.7. A remote attacker c...

PT-2017-12064

Name of the Vulnerable Software and Affected Versions Yii Framework version 2.0.12 Description A security issue exists due to the mishandling of $exception-errorInfo in the exception screen when debug mode is enabled. This affects the framework/views/errorHandler/exception.php file. Recommendatio...

CVE-2017-0378

XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...

Cross site scripting

XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...

CVE-2017-0378: Improper Neutralization of Input During Web Page Generation

XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...

Treehugger External Link System suffers from SQL Injection Vulnerability

Tree Hole external chain system is a free open source PHP external chain network disk system , support for a variety of storage methods , multi-user system . Tree Hole external link system in shudong\views\userFiles file in the existence of SQL injection vulnerability , due to the failure of the...

CVE-2017-9449

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible ...

PT-2017-18928

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by creating a crafted table name at the "admin/developer/modules/views/create/" endpoint and the...