Drupal Core 7.x Multiple Vulnerabilities - CVE-2016-3164

Drupal Core is prone to multiple vulnerabilities including security bypass denial of service open redirect reflected file download brute force amplification and information disclosure vulnerabilities. Exploiting these issues could allow an attacker to perform otherwise restricted actions and subsequently view delete or substitute a link to a file to cause the affected website to consume memory and CPU resources by blocking file uploads thus denying service to legitimate users to redirect users to arbitrary web sites and conduct phishing attacks to trick a user into downloading and running a file with arbitrary JSON-encoded content to determine user passwords by submitting a large number of password variations at once or to obtain sensitive information that may help in launching further attacks. Drupal Core versions 7.x ranging from 7.0 and up to and including 7.42 are vulnerable.