FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  318453
Date:      2013-05-18
Time:      20:35:07Z
Committer: rakuco

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
10720fe8-51e0-11e1-91c1-00215c6a37bb	drupal -- multiple vulnerabilities Drupal development team reports: Cross Site Request Forgery vulnerability in Aggregator module CVE: CVE-2012-0826 An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service. This issue affects Drupal 6.x and 7.x. OpenID not verifying signed attributes in SREG and AX CVE: CVE-2012-0825 A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information. This issue affects Drupal 6.x and 7.x. Access bypass in File module CVE: CVE-2012-0827 When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to. This issue affects Drupal 7.x only. Discovery 2012-02-01 Entry 2012-02-07 drupal6 lt 6.23 drupal7 lt 7.11 CVE-2012-0825 CVE-2012-0826 CVE-2012-0827
10720fe8-51e0-11e1-91c1-00215c6a37bb	drupal -- multiple vulnerabilities Drupal development team reports: Cross Site Request Forgery vulnerability in Aggregator module CVE: CVE-2012-0826 An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service. This issue affects Drupal 6.x and 7.x. OpenID not verifying signed attributes in SREG and AX CVE: CVE-2012-0825 A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information. This issue affects Drupal 6.x and 7.x. Access bypass in File module CVE: CVE-2012-0827 When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to. This issue affects Drupal 7.x only. Discovery 2012-02-01 Entry 2012-02-07 drupal6 lt 6.23 drupal7 lt 7.11 CVE-2012-0825 CVE-2012-0826 CVE-2012-0827

VuXML ID

Description

10720fe8-51e0-11e1-91c1-00215c6a37bb

drupal -- multiple vulnerabilities

Drupal development team reports:

Cross Site Request Forgery vulnerability in Aggregator module

CVE: CVE-2012-0826

An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service.

This issue affects Drupal 6.x and 7.x.

OpenID not verifying signed attributes in SREG and AX

CVE: CVE-2012-0825

A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information.

This issue affects Drupal 6.x and 7.x.

Access bypass in File module

CVE: CVE-2012-0827

When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to.

This issue affects Drupal 7.x only.

Discovery 2012-02-01
Entry 2012-02-07
drupal6

lt 6.23

drupal7

lt 7.11

CVE-2012-0825
CVE-2012-0826
CVE-2012-0827