Custom Tokens - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-041

The Custom Tokens module enables you to create custom tokens for specific replacements that can improve other modules relying on the token API. The module doesn't sufficiently identify that its custom permissions are risky and should only be granted to highly trusted roles. This vulnerability is...

Cross-site Scripting (XSS)

drupal/drupal is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the inclusion of a vulnerable jQuery which allows untrusted domains request through AJAX requests, allowing XSS to occur...

Drupal Panopoly Core Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal's Panopoly Core module that stems from not properly handling partial node titles. The vulnerability can be exploited ...

Drupal me Module Arbitrary Code Execution Vulnerability

Drupal is a free and open source content management system developed in PHP. An arbitrary code execution vulnerability exists in the me module of Drupal. Exploitation of this vulnerability could allow an attacker to execute arbitrary code in an affected application environment, and a failed attac...

Drupal Services Single Sign-On Client Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A cross-site scripting attack vulnerability exists in the Services Single Sign-...

Drupal Cloud Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A cross-site request forgery vulnerability exists in Drupal's Cloud module. An...

Drupal Custom Permissions module access bypass vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Custom Permissions is one of the modules that allows additional permissions to be created and managed through administrative forms. An access bypass vulnerability exists in Drupal's...

DRUPAL-CONTRIB-2018-040

This module enables you to delete any types of entities in bulk. The module doesn't sufficiently verify access permissions under its use cases, leading to access bypass. The module also does not protect against Cross Site Request Forgeries on its delete process. The access bypass vulnerability is...

DRUPAL-CONTRIB-2018-039

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read:...

DRUPAL-CONTRIB-2018-038

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: . The security team marks all unsupported projects critical by default...

Drupal RESTWS Module Page Callback RCE

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the bundled RESTful Web services RESTWS module due to a flaw in how default page callbacks for Drupal entities are altered when handling specially crafted requests. An unauthenticated,...

Drupalgeddon 2.0 Still Haunting 115K+ Sites

More than 115,000 sites are still vulnerable to a highly critical Drupal bug – even though a patch was released three months ago. When it was first revealed, the bug, which has been dubbed Drupalgeddon 2.0, impacted an estimated 1+ million sites running Drupal – including major U.S. educational...

Over 115,000 Drupal Sites Still Vulnerable to Drupalgeddon2 Exploit

Hundreds of thousands of websites running on the Drupal CMS—including those of major educational institutions and government organizations around the world—have been found vulnerable to a highly critical flaw for which security patches were released almost two months ago. Security researcher Troy...

Over 115,000 Drupal Sites Still Vulnerable to Drupalgeddon2 Exploit

Hundreds of thousands of websites running on the Drupal CMS—including those of major educational institutions and government organizations around the world—have been found vulnerable to a highly critical flaw for which security patches were released almost two months ago. Security researcher Troy...

Access Restriction Bypass

drupal is vulnerable to access restriction bypass. The bypass is possible because Settings Tray module lack a correct check for permission to update certain data...

Access Restriction Bypass

drupal is vulnerable to access restriction bypass. The bypass is possible because it uses the default fallback for access queries while using node access controls with a multilingual site, leading to the bypass of access restriction...

Unauthorized Access

drupal/drupal is vulnerable to unauthorized access attacks. The vulnerability exists in the Comment reply form where users who can post comments are able to view and add comments that they are not authorized to do so...

Drupal Permissions by Term Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.The Permissions by Term module is a module from Drupal. The module provides both front-end and back-end functionality. No programming skills are required, and the module can be handled ...

Drupal Automated Logout Module HTML Injection Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An HTML injection vulnerability exists in Drupal's Automated Logout module that stems from a failure to adequately validate user input. An attacker could exploit this...

Drupal Mosaik Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Mosaik module that stems from a failure to adequately validate user text input. An attacker could use the...