FreshPorts - VuXML

Drupal Security Team reports:

• File upload access bypass and denial of service (File module - Drupal 7 and 8 - Moderately Critical)

• Brute force amplification attacks via XML-RPC (XML-RPC server - Drupal 6 and 7 - Moderately Critical)

• Open redirect via path manipulation (Base system - Drupal 6, 7 and 8 - Moderately Critical)

• Form API ignores access restrictions on submit buttons (Form API - Drupal 6 - Critical)

• HTTP header injection using line breaks (Base system - Drupal 6 - Moderately Critical)

• Open redirect via double-encoded 'destination' parameter (Base system - Drupal 6 - Moderately Critical)

• Reflected file download vulnerability (System module - Drupal 6 and 7 - Moderately Critical)

• Saving user accounts can sometimes grant the user all roles (User module - Drupal 6 and 7 - Less Critical)

• Email address can be matched to an account (User module - Drupal 7 and 8 - Less Critical)

• Session data truncation can lead to unserialization of user provided data (Base system - Drupal 6 - Less Critical)

< 6.38

< 7.43

< 8.0.4

These packages have reached End of Life status and/or have been removed from the Ports Tree. They may contain undocumented security issues. Please take caution and find alternative software as soon as possible.

>= 0

>= 0