Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/52631?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "type": "composer", "namespace": "drupal", "name": "core", "version": "8.0.4", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "8.1.0", "latest_non_vulnerable_version": "11.2.8", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38082?format=api", "vulnerability_id": "VCID-56ze-2yw2-bfh8", "summary": "Reflected file download vulnerability\nThe System module in Drupal might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3168" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-56ze-2yw2-bfh8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38077?format=api", "vulnerability_id": "VCID-5c5c-m7ba-kqct", "summary": "Open redirect via double-encoded 'destination' parameter\nOpen redirect vulnerability in the `drupal_goto` function in Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the `destination` parameter.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3167" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5c5c-m7ba-kqct" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38084?format=api", "vulnerability_id": "VCID-n5n3-p5yy-13d9", "summary": "Open redirect via path manipulation\nDrupal might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on an error page, related to path manipulation.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3164", "reference_id": "CVE-2016-3164", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3164" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3164" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n5n3-p5yy-13d9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38080?format=api", "vulnerability_id": "VCID-ng6g-hvc2-bkg4", "summary": "Session data truncation can lead to unserialization of user provided data\nDrupal might allow remote attackers to execute arbitrary code via vectors related to session data truncation.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3171" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ng6g-hvc2-bkg4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38078?format=api", "vulnerability_id": "VCID-pnme-dc73-efcb", "summary": "Improper Access Control\nThe File module in Drupal allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3162" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pnme-dc73-efcb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38071?format=api", "vulnerability_id": "VCID-rsc6-y1uv-6bfq", "summary": "Information Exposure\nThe `have you forgotten your password` links in the User module in Drupal allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3170" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rsc6-y1uv-6bfq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38079?format=api", "vulnerability_id": "VCID-ta99-gcmk-2qc8", "summary": "Brute force amplification attacks via XML-RPC\nThe XML-RPC system in Drupal might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3163" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ta99-gcmk-2qc8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38072?format=api", "vulnerability_id": "VCID-wapd-e3mu-sffn", "summary": "HTTP header injection using line breaks\nCRLF injection vulnerability in the `drupal_set_header` function in Drupal allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.", "references": [ { "reference_url": "https://www.drupal.org/SA-CORE-2016-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2016-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52631?format=api", "purl": "pkg:composer/drupal/core@8.0.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" } ], "aliases": [ "CVE-2016-3166" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wapd-e3mu-sffn" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.4" }