Drupal Core Remote Code Execution (CVE-2018-7600)

A code execution vulnerability exists in Drupal Core. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Debian DLA-1325-1 : drupal7 security update (Drupalgeddon 2)

Jasper Mattsson found a remote code execution vulnerability in the Drupal content management system. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. For further information please refer to the...

Drupal 8.4.x < 8.4.6 RCE

Binary data 700229.prm...

Drupal 8.x < 8.3.9 RCE

Binary data 700228.prm...

Drupal 8.5.x < 8.5.1 RCE

Binary data 700230.prm...

Drupal Core Critical RCE Vulnerability (SA-CORE-2018-002) - Windows, Version Check

Drupal is prone to a critical remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Drupal Core Critical RCE Vulnerability (SA-CORE-2018-002) - Linux, Version Check

Drupal is prone to a critical remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Drupal core remote code execution vulnerability (CNVD-2018-06660)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in several sub-versions of Drupal, which could be exploited by an attacker to achieve a remote code execution attack, thereby...

Drupal 7.x < 7.58 RCE

Binary data 700224.prm...

Highly critical - Remote Code Execution

More info at https://www.drupal.org/sa-core-2018-002...

Highly critical - Remote Code Execution

More info at https://www.drupal.org/sa-core-2018-002...

DRUPAL-CORE-2018-002

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ about this issue...

Drupal Releases Critical Security Updates

Drupal has released critical updates addressing a vulnerability in Drupal 8, 7, and 6. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Drupal's Security Advisory and apply the necessary updates...

PT-2018-3600

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.58 Drupal versions 8.x prior to 8.3.9 Drupal versions 8.4.x prior to 8.4.6 Drupal versions 8.5.x prior to 8.5.1 Description The issue is related to insufficient input validation in the Drupal CMS system, allowing a...

Drupal 7.x < 7.58 / 8.3.x < 8.3.9 / 8.4.x < 8.4.6 / 8.5.x < 8.5.1 Remote Code Execution Vulnerability (SA-CORE-2018-002)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.58, 8.3.x prior to 8.3.9, 8.4.x prior to 8.4.6, or 8.5.x prior to 8.5.1. It is, therefore, affected by a remote code execution vulnerability. Note that Nessus has not tested for these...

Drupal Drupalgeddon 2 Forms API Property Injection

This module exploits a Drupal property injection in the Forms API. Drupal 6.x, use exploit/unix/webapp/drupal/drupalgeddon2 msf undefineddrupalgeddon2 show actions ...actions... msf undefineddrupalgeddon2 set ACTION msf undefineddrupalgeddon2 show options ...show and set options... msf...

Drupal Configuration Backup Files Detected

The scanner has detected publicly accessible Drupal configuration files on the target web application. These files likely contains extremely sensitive server information including administrative database credentials. This may present an attacker with an exploit vector which could be leveraged usi...

New Relic: Drupal admin takeover via install.php not being performed prior to install.

@grampae discovered an uninitialized Drupal instance running on one of our properties being hosted by a third party provider, an issue we've seen previously. To prevent this issue from surfacing again, we decommissioned the related domains and contacted the provider with details of the issue...

Drupal Forewarns ‘Highly Critical’ Bug to be Patched Next Week

UPDATE Drupal developers are being asked to give themselves extra time next week to fix a “highly critical” flaw in Drupal 7 and 8 core. In an advisory sent to developers on Wednesday, Drupal notified them that, “there will be a security release of Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x on March 28t...

DRUPAL-CONTRIB-2018-016

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when viewing related resources or relationships, thereby causing an access bypass vulnerability. This vulnerability is...