Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: XSS always requires extra effort in a pentest, it depends on the actual app...

Drupal File file_create_filename Persistent Cross-Site Scripting Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Drupal. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the...

Drupal 8.5.x < 8.5.8 / 8.6.x < 8.6.2 Open Redirect

The instance of Drupal running on the remote web server is affected by an open redirect vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to redirect a victim from an intended legitimate website to an arbitrary website, thereby exposing the users to...

Drupal XSS Vulnerability (SA-CORE-2019-004) - Linux

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Drupal 7.x < 7.65 / 8.5.x < 8.5.14 / 8.6.x < 8.6.13 XSS (SA-CORE-2019-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.65, 8.5.x prior to 8.5.14, or 8.6.x prior to 8.6.13. It is, therefore, affected by a cross site scripting XSS vulnerability in the File module/subsystem due to improper sanitization o...

Drupal XSS Vulnerability (SA-CORE-2019-004) - Windows

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser under certain circumstances that allows uploading of a file with a malicious file name through the File module...

Drupal 8.5.x < 8.5.14 Cross-Site Scripting

According to its self-reported version number, the detected Drupal application is affected by a cross-site scripting XSS vulnerability in File module/subsystem due to improper sanitization of data in uploaded files. Note that the scanner has not tested for these issues but has instead relied only...

Drupal 7.x < 7.65 Cross-Site Scripting

According to its self-reported version number, the detected Drupal application is affected by a cross-site scripting XSS vulnerability in File module/subsystem due to improper sanitization of data in uploaded files. Note that the scanner has not tested for these issues but has instead relied only...

Drupal 8.6.x < 8.6.13 Cross-Site Scripting

According to its self-reported version number, the detected Drupal application is affected by a cross-site scripting XSS vulnerability in File module/subsystem due to improper sanitization of data in uploaded files. Note that the scanner has not tested for these issues but has instead relied only...

DRUPAL-CORE-2019-004

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

DRUPAL-CONTRIB-2019-039

This module enables you to add social media share buttons on your website to its content and pages. The module doesn't sufficiently mark its administration permission restricted, allowing cross site scripting vulnerabilities to users who have access to its admin settings. This vulnerability is...

Drupal Releases Security Updates

Drupal has released security updates to address a vulnerability in Drupal Core. A remote attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the Drupal Security...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

drupal -- Drupal core - Moderately critical - Cross Site Scripting

Drupal Security Team reports: Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

Views (for Drupal 7) - Moderately critical - Information disclosure - SA-CONTRIB-2019-035

This module enables you to create customized lists of data. The module doesn't sufficiently build queries when used with exposed filters, leading to a possible information disclosure vulnerability in certain rare circumstances. This vulnerability is mitigated by the fact that a view must have an...

Views (for Drupal 7) - Less critical - Cross site scripting - SA-CONTRIB-2019-036

This module enables you to create customized lists of data. The module doesn't sufficiently sanitize certain field types, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that a view must display a field with the format "Full data serialized" and an...

Drupal Version End of Life Advanced Notification

The installation of Drupal running on the remote host will be no longer supported in November 2023. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. No source data...

Views (for Drupal 7) - Moderately critical - Information Disclosure - SA-CONTRIB-2019-034

This module enables you to create customized lists of data. The module doesn't sufficiently protect against argument definitions failing. This vulnerability is mitigated by the fact that a view must have custom PHP code used as a field validator...

Fedora 29 : drupal8 / php-typo3-phar-stream-wrapper2 (2019-46107f296c)

drupal8 Upstream : - https://www.drupal.org/project/drupal/releases/8.6.10 - https://www.drupal.org/SA-CORE-2019-003 - https://www.drupal.org/project/drupal/releases/8.6.9 - https://www.drupal.org/project/drupal/releases/8.6.8 - https://www.drupal.org/project/drupal/releases/8.6.7 -...