[SECURITY] Fedora 23 Update: drupal6-views_bulk_operations-1.17-1.fc23

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

Ctools - Critical - Multiple Vulnerabilities - SA-CONTRIB-2015-141

Cross Site Scripting XSS Ctools in Drupal 6 provides a number of APIs and extensions for Drupal, and is a dependency for many of the most popular modules, including Views, Panels and Entityreference. Many features introduced in Drupal Core once lived in ctools. This vulnerability can be mitigated...

CVE-2015-5515

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

CVE-2015-5509

The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access to administration pages, which allows remote administrators to bypass intended restrictions via unspecified vectors...

Authentication flaw

The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access to administration pages, which allows remote administrators to bypass intended restrictions via unspecified vectors...

CVE-2015-5490

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

Design/Logic Flaw

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

CVE-2015-5512

The CVE-2015-5512 entry concerns the Drupal contributed module “me aliases.” The vulnerability affects me aliases 6.x-2.x prior to 6.x-2.10 and 7.x-1.x prior to 7.x-1.2, where the Views “me” user argument handler can be manipulated by substituting a user ID with the literal string “me” in a URL, ...

CVE-2015-5509

CVE-2015-5509 affects the Drupal contributed module Administration Views (7.x-1.x) prior to 7.x-1.4. When used in combination with other unspecified modules, it can bypass access restrictions to administration pages, allowing remote administrators to view/modify restricted areas. The issue is tie...

CVE-2015-5490

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

CVE-2015-5509

The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access to administration pages, which allows remote administrators to bypass intended restrictions via unspecified vectors...

CVE-2015-5490

The CVE-2015-5490 vulnerability affects the Drupal Views module (7.x-3.x) specifically versions 7.x-3.5 through 7.x-3.10. The root cause is that _views_fetch_data in includes/cache.inc does not rebuild the full cache when the static cache is non-empty, allowing remote attackers to bypass configur...

CVE-2015-5512: Improper Access Control

The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me" user argument handler by substituting "me" for a user id in a URL...

PT-2015-6964

Name of the Vulnerable Software and Affected Versions Drupal me aliases module versions 6.x-2.x before 6.x-2.10 Drupal me aliases module versions 7.x-1.x before 7.x-1.2 Description The issue allows remote attackers to access Views by substituting 'me' for a user id in a URL, using the 'me' user...

CVE-2015-5515: Undefined Security Weakness

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

CVE-2015-5509: Undefined Security Weakness

The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access to administration pages, which allows remote administrators to bypass intended restrictions via unspecified vectors...

PT-2015-6942

Name of the Vulnerable Software and Affected Versions Views module versions 7.x-3.5 through 7.x-3.10 for Drupal Description The issue concerns the views fetch data method in the Views module for Drupal, which fails to rebuild the full cache if the static cache is not empty. This allows remote...

PT-2015-6961

Name of the Vulnerable Software and Affected Versions Administration Views module versions 7.x-1.x before 7.x-1.4 for Drupal Description The issue allows remote administrators to bypass intended restrictions via unspecified vectors due to improper access granting to administration pages when used...

PT-2015-6967

Name of the Vulnerable Software and Affected Versions Views Bulk Operations VBO module versions 6.x-1.x and 7.x-3.x before 7.x-3.3 Description The issue allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing...

CVE-2015-5490: Exposure of Sensitive Information to an Unauthorized Actor

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...