Drupal RESTful Web Services RCE

Remote Code Execution in Drupal RESTful Web Services module Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

3 Popular Drupal Modules Found Vulnerable — Patch Released

Just yesterday, I wrote a warning article announcing that Drupal – the popular open source content management system – will release patches for several highly critical Remote Code Execution RCE bugs that could allow attackers to fully take over any affected site. Below are the three separate Drup...

Drupal Patches Three Remote Code Execution Vulnerabilities in Modules

Developers with the open source content management framework Drupal today patched a series of highly critical remote code execution bugs in three separate modules. If exploited, the bugs could let an attacker take over any site running the modules. Fixes for pushed for RESTful Web Services, a...

Several Critical Remotely Exploitable Flaws Found in Drupal Modules, patch ASAP!

The extraordinary 'Panama Papers leak' from Law firm Mossack Fonseca that exposed the tax-avoiding efforts by the world's richest and most influential members was initially believed to be the result of an unpatched vulnerability in the popular content management systems: Drupal and WordPress. Now...

Drupal RESTWS Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal RESTWS module. An attacker can exploit the vulnerability by sending a specially crafted request that results in...

Drupal Coder Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language maintained by the Drupal community; Coder is Drupal's encoder module. A remote code execution vulnerability exists in the Drupal Coder module. Because the module does not adequately validate user-entered script...

Coder - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-039

The Coder module checks your Drupal code against coding standards and other best practices. It can also fix coding standard violations and perform basic upgrades on modules. The module doesn't sufficiently validate user inputs in a script file that has the php extension. A malicious unauthenticat...

RESTWS - Highly critical - Remote code execution - SA-CONTRIB-2016-040

This module enables you to expose Drupal entities as RESTful web services. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this approach allows an attacker to send specially crafted requests resulting in arbitrary PHP execution. There...

Drupal CODER Module Remote Command Execution

This module exploits a Remote Command Execution vulnerability in the Drupal CODER Module. Unauthenticated users can execute arbitrary commands under the context of the web server user. The CODER module doesn't sufficiently validate user inputs in a script file that has the PHP extension. A...

Drupal RESTWS Module Remote PHP Code Execution

This module exploits a Remote PHP Code Execution vulnerability in the Drupal RESTWS Module. Unauthenticated users can execute arbitrary code under the context of the web server user. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this...

Drupal Webform Multiple File Upload Remote Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community; Webform Multiple File Upload module is a file upload module for Drupal. A remote code execution vulnerability exists in the Drupal Webform Multiple File Upload module. The vulnerabilit...

Webform Multiple File Upload - Critical - Remote Code Execution - SA-CONTRIB-2016-038

The Webform Multiple File Upload module allows users to upload multiple files on a Webform. The Webform Multifile File Upload module contains a Remote Code Execution RCE vulnerability where form inputs will be unserialized and a specially crafted form input may trigger arbitrary code execution...

Updated drupal packages fix security vulnerabilities

Updated drupal packages fix security vulnerability: A vulnerability exists in the User module, where if some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can be granted all user roles on the site. This would typically result in the user gainin...

MGASA-2016-0245 Updated drupal packages fix security vulnerabilities

Updated drupal packages fix security vulnerability: A vulnerability exists in the User module, where if some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can be granted all user roles on the site. This would typically result in the user gainin...

Drupal 6.22 - menupereid SQL injection vulnerability

No description provided by source...

Instagram Block - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-037

This module enables you to authenticate with Instagram's API via an intermediary service instagram.yanniboi.com. The module doesn't sufficiently advise that your authentication tokens could be intercepted. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in...

[SECURITY] Fedora 23 Update: drupal7-7.44-1.fc23

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 22 Update: drupal7-7.44-1.fc22

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 24 Update: drupal7-7.44-1.fc24

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Drupal 7.x < 7.44 / 8.x < 8.1.3 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 7.x prior to 7.44 or 8.x prior to 8.1.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the Views module that allows an unauthenticated, remote attacker to bypass restrictions and disclose the number of hi...