14612 matches found
Drupal Releases Security Updates
Drupal has released security updates to address a vulnerability in Drupal Core. A remote attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Drupal’s security...
Drupal 8.6.x < 8.6.10 Remote Code Execution Vulnerability
According to its self-reported version, the instance of Drupal running on the remote web server is 8.5.x prior to 8.5.11 or 8.6.x prior to 8.6.10. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of data from non-form sources. Note that the scanner...
DRUPAL-CORE-2019-003
Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services rest module enabled and allows GET, PAT...
DRUPAL-CONTRIB-2019-025
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
DRUPAL-CONTRIB-2019-024
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
DRUPAL-CONTRIB-2019-023
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
DRUPAL-CONTRIB-2019-022
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
DRUPAL-CONTRIB-2019-021
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
DRUPAL-CONTRIB-2019-019
This resolves issues described in SA-CORE-2019-003 for this module...
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003
Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services rest module enabled and allows GET, PAT...
Drupal 8.6.x < 8.6.10 RCE (SA-CORE-2019-003)
Binary data 700420.prm...
Drupal RESTful Web Services unserialize() RCE
This module exploits a PHP unserialize vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also vulnerable albeit cached...
drupal -- Drupal core - Highly critical - Remote Code Execution
Drupal Security Team Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases...
Drupal 8.5.x < 8.5.11 RCE (SA-CORE-2019-003)
Binary data 700419.prm...
Drupal 8.5.x < 8.5.11 / 8.6.x < 8.6.10 Remote Code Execution (SA-CORE-2019-003)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.5.x prior to 8.5.11, or 8.6.x prior to 8.6.10. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of data from non-form sources. %NASLMINLEVEL 70300 C...
ZRECore 1.3.1 Database Configuration Disclosure
Exploit Title : ZRECore 1.3.1 Database Config Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : zend.com Software Download Link : github.com/zrecore/ZRECore/archive/master.zip Software Information Link :...
Drupal OAuth & OpenID Connect Login - OAuth2 Client SSO Login - Critical - Multiple Vulnerabilities - SA-CONTRIB-2019-016
This module enables you to allow login into the Drupal websites through an external provider over the OAuth 2.0 protocol. The module sets a Drupal variable used for redirection based on unsanitised user input, leading to an Open Redirect vulnerability. It also fails to sanitise user input which i...
DRUPAL-CONTRIB-2019-013
This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account. The module...
Public Download Count - Less critical - Open Redirect Vulnerability - SA-CONTRIB-2019-012
This module enables you to track download counts of files linked from a Drupal site. Links in Drupal content are rewritten to go through an intermediate page that records download stats and then redirects to the final destination. The module did not verify that the links provided to the...