PT-2018-18169

Name of the Vulnerable Software and Affected Versions Drupal versions 7.x through 8.x Description A remote code execution issue exists within multiple subsystems of Drupal. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being...

Drupal Form API command execution

Added: 04/25/2018 CVE: CVE-2018-7600 BID: 103534 Background Drupal is an open-source content management system written in PHP. Problem Insufficient sanitization on Form API AJAX requests could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Drupal 7.58, 8.3.9, 8.4.6,...

DRD Agent - Critical - PHP object injection - SA-CONTRIB-2018-022

This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for administrators in a central dashboard. The modules DRD and DRD Agent encrypt the data which is exchanged between them but in order to do so, they use the PHP serialize/unserialize...

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

DSA-4180-1 drupal7 - security update

Bulletin has no description...

Drupal 7.x < 7.59 / 8.4.x < 8.4.8 / 8.5.x < 8.5.3 Remote Code Execution Vulnerability (SA-CORE-2018-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.59, 8.4.x prior to 8.4.8, or 8.5.x prior to 8.5.3. It is, therefore, affected by a remote code execution vulnerability. Note that Nessus has not tested for these issues but has instea...

Drupal 7.58 - Drupalgeddon3 (Authenticated) Remote Code Execution (PoC)

Drupal 7.58 - Drupalgeddon3 Authenticated Remote Code Execution PoC This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602. You must be authenticated and with the power of deleting a node. Some other forms may be vulnerable : at least, all of forms that is in...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team reports: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to...

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)

This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602. You must be authenticated and with the power of deleting a node. Some other forms may be vulnerable : at least, all of forms that is in 2-step form then confirm. POST...

Drupal Form API command execution

Added: 04/25/2018 CVE: CVE-2018-7600 BID: 103534 Background Drupal is an open-source content management system written in PHP. Problem Insufficient sanitization on Form API AJAX requests could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Drupal 7.58, 8.3.9, 8.4.6,...

Drupal Form API command execution

Added: 04/25/2018 CVE: CVE-2018-7600 BID: 103534 Background Drupal is an open-source content management system written in PHP. Problem Insufficient sanitization on Form API AJAX requests could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Drupal 7.58, 8.3.9, 8.4.6,...

[SECURITY] Fedora 26 Update: drupal8-8.3.9-1.fc26

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Muhstik Botnet Exploits Highly Critical Drupal Bug

Researchers are warning a recently discovered and highly critical vulnerability found in Drupal’s CMS platform is now being actively exploited by hackers who are using it to install cryptocurrency miners and to launch DDoS attacks via compromised systems. At the time of the disclosure, last month...

Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure

Drupal avataruploader v7.x-1.0-beta8 - Arbitrary File Disclosure Title: Drupal avataruploader v7.x-1.0-beta8 - Arbitrary File Disclosure Author: Larry W. Cashdollar Date: 2018-03-30 CVE-ID: CVE-2018-9205 Download Site: https://www.drupal.org/project/avataruploader Vendor:...

Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure

Title: Drupal avataruploader v7.x-1.0-beta8 - Arbitrary File Disclosure Author: Larry W. Cashdollar Date: 2018-03-30 CVE-ID: CVE-2018-9205 Download Site: https://www.drupal.org/project/avataruploader Vendor: https://www.drupal.org/u/robbinzhao Vendor Notified: 2018-04-02 Vendor Contact:...

seacoasttrail.com XSS vulnerability

Open Bug Bounty ID: OBB-606555 Description| Value ---|--- Affected Website:| seacoasttrail.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Drupal Avatar Uploader 7.x-1.0-beta8 Arbitary File Download Vulnerability

Exploit for php platform in category web applications Title: Arbitrary file download vulnerability in Drupal module avataruploader v7.x-1.0-beta8 Author: Larry W. Cashdollar CVE-ID:CVE-2018-9205 Download Site: https://www.drupal.org/project/avataruploader Vendor: https://www.drupal.org/u/robbinzh...

Drupal Avatar Uploader 7.x-1.0-beta8 Arbitary File Download

Title: Arbitrary file download vulnerability in Drupal module avataruploader v7.x-1.0-beta8 Author: Larry W. Cashdollar Date: 2018-03-30 CVE-ID:CVE-2018-9205 Download Site: https://www.drupal.org/project/avataruploader Vendor: https://www.drupal.org/u/robbinzhao Vendor Notified: 2018-04-02 Vendor...

Drupalgeddon Two.

New Drupal Vulnerability in Detail By @aLLy The second Drupalgeddon has come! It is a new variant of a critical vulnerability in one of the most popular CMSs, which caused a big stir. This newly-discovered breach allows any unregistered user execute commands in the target system by means of a...

FreeBSD : drupal -- Drupal core - Moderately critical (33174280-43fa-11e8-aad5-6cf0497db129)

The Drupal security team reports : CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site scripting XSS vulnerability. The vulnerability stemmed from the fact that it was possible to execute XSS inside CKEditor when using the image2 plugin which Drupal 8 core...