CVE-2014-1398

CVE-2014-1398 affects Drupal: the Entity API module (7.x-1.x) before 7.x-1.3 may let remote authenticated users bypass access restrictions on comment, user and node statistics properties via unspecified vectors. Connected documents confirm fixes in 7.x-1.3 (e.g., Fedora updates for drupal7-entity...

CVE-2014-1399

CVE-2014-1399 affects Drupal’s Entity API module (Entity API, 7.x-1.x) prior to 7.x-1.3. The vulnerability in the entity wrapper access API may allow remote authenticated users to bypass intended access restrictions on referenced entities via unspecified vectors. The NVD entry notes remote authen...

CVE-2014-1400

CVE-2014-1400 affects Drupal’s Entity API module (7.x-1.x) before 7.x-1.3. The entity_access API flaw could allow remote authenticated users to bypass access restrictions and read unpublished comments via unspecified vectors. The issue has a published remediation: upgrade to 7.x-1.3. If exploitat...