TB Nucleus - Critical - Unsupported - SA-CONTRIB-2018-031

Update - 2018-09-26 This maintainer has fixed this security issue. Please install https://www.drupal.org/project/nucleus/releases/7.x-1.6 to fix the security issue The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the...

SimpleCrop - Critical - Unsupported - SA-CONTRIB-2018-030

Update: 2018-06-01 A new maintainer has stepped forward to maintain this module and has put out a new release. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module...

Drupal < 7.58 / 8.x < 8.3.9 / 8.4.x < 8.4.6 / 8.5.x < 8.5.1 Remote Code Execution

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. Note: This has been detected using an active check and...

A week in security (May 14 – May 20)

Last week, we looked at the deluge of incoming policies caused by GDPR, tackled Adobe Reader zero days, and ran through some iPhone security tips. We also caught some helpline scammers in the act, explored advergaming, got our Senate Bill game face on, and deep dived into Drupal vulnerabilities...

Drupal Skype Status Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability in the Drupal Skype Status module exists because the program fails to adequately validate user input. An attacker could use the...

Drupal Yandex.Metrics module cross-site scripting vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Yandex.Metrics module that stems from a failure to adequately validate user input. The vulnerability can be...

Drupal netFORUM Authentication Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. netFORUM Authentication is one of the modules that implements external authentication for users . An access bypass vulnerability exists in the Drupal netFORUM Authentication module. An...

Drupal Avatar Uploader File Disclosure

File disclosure vulnerability in Drupal Avatar Uploader module Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

A look into Drupalgeddon’s client-side attacks

Drupal is one of the most popular Content Management Systems CMS, along with WordPress and Joomla. In late March 2018, Drupal was affected by a major remote code execution vulnerability CVE-2018-7600 followed by yet another CVE-2018-7602 almost a month later, both aptly nicknamed Drupalgeddon 2 a...

Open Redirect

Drupal is vulnerable to open redirects. A malicious user can inject a malicious link to the application through the language switcher, which can then be used to cause open redirects...

Drupal Clientside Validation Module Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal Clientside Validation module. An attacker can exploit the vulnerability to execute arbitrary PHP code in the...

Drupal CKEditor Enhanced Image plugin cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.CKEditor is one of the text editors.Enhanced Image aka image2 is one of the image enhancement plugins. A cross-site scripting vulnerability exists in the Enhanced Image plugin in Drupal...

Drupal H5P Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A cross-site scripting attack vulnerability exists in the Drupal H5P module,...

Cross-site Scripting (XSS)

drupal/drupal is vulnerable to cross-site scripting XSS attacks. The checkPlain function doesn't properly sanitize escape characters, allowing a malicious user to inject and execute arbitrary Javascript...

Drupal Alinks Module Authentication Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An authentication bypass vulnerability exists in the Drupal Alinks module. An attacker can exploit the vulnerability to bypass security restrictions and perform unauthoriz...

[SECURITY] Fedora 27 Update: drupal7-7.59-1.fc27

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 27 Update: drupal8-8.4.8-1.fc27

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 26 Update: drupal7-7.59-1.fc26

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 28 Update: drupal8-8.4.8-1.fc28

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

DRUPAL-CONTRIB-2018-027

This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create...