Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Debian · 8 | drupal7 | 7.32-1+deb8u10 |
| Debian · 9 | drupal7 | 7.52-2+deb9u2 |
Vulnerabilities 4
-
Medium 6.1
Drupal cross-site scripting vulnerability
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoe…
-
Medium 6.1
Drupal cross site scripting vulnerability
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already…
-
Medium 5.3
Drupal access bypass vulnerability
Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying t…
-
Medium 4.7
Drupal external link injection vulnerability
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users int…