14437 matches found
CVE-2023-5256 Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...
CVE-2023-5256 Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...
CVE-2023-5256
Summary: CVE-2023-5256 affects Drupal sites with the JSON:API module enabled. In certain scenarios, the module outputs error backtraces that may cause sensitive information to be cached and accessible to anonymous users, enabling privilege escalation. Affected scope: Drupal installations with JSO...
CVE-2023-5256 Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...
Exploit for CVE-2013-0422
K8tools 20190727 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 博客: https://www.cnblogs.com/k8gege 下载: https://github.com/k8gege/K8tools PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 综合工具 K8飞刀Final.rar + K8data.mdb K8飞刀漏洞数据库20190402 + K8expList.txt...
Drupal 8.7.x < 9.5.11 Cache Poisoning
According to its self-reported version, the instance of Drupal running on the remote web server is 8.7.x prior to 9.5.11, 10.0.x prior to 10.0.11 or 10.1.x prior to 10.1.4. In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause...
Drupal Security Vulnerabilities
Drupal is an open source content management system developed by the Drupal community using the PHP language. A security vulnerability exists in Drupal. An attacker exploiting the vulnerability could obtain sensitive information and elevate privileges...
Drupal 10.0.x < 10.0.11 Cache Poisoning
According to its self-reported version, the instance of Drupal running on the remote web server is 8.7.x prior to 9.5.11, 10.0.x prior to 10.0.11 or 10.1.x prior to 10.1.4. In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause...
Drupal 10.1.x < 10.1.4 Cache Poisoning
According to its self-reported version, the instance of Drupal running on the remote web server is 8.7.x prior to 9.5.11, 10.0.x prior to 10.0.11 or 10.1.x prior to 10.1.4. In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause...
DRUPAL-CONTRIB-2023-047
This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece of content is transitioned from one state to another via core's content\moderation module. The module doesn't sufficiently check access to content when sending notifications. Th...
Drupal Releases Security Advisory to Address Vulnerability in Drupal Core
Drupal has released a security advisory to address a vulnerability affecting multiple Drupal versions. A malicious cyber actor could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Drupal security advisory SA-CORE- 2023-006link ...
Drupal Cache Poisoning Vulnerability (SA-CORE-2023-006) - Linux
Drupal is prone to a cache poisoning vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Vulnerability fixed in Drupal
Drupal has fixed a vulnerability in Drupal core. The vulnerability is located in the JSON:API module and allows an unauthenticated malicious party to gain access to sensitive data. No CVE ID has been disclosed for this vulnerability yet. Drupal has released updates to fix the vulnerability in...
Drupal Cache Poisoning Vulnerability (SA-CORE-2023-006) - Windows
Drupal is prone to a cache poisoning vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
DRUPAL-CORE-2023-006
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...
Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...
Drupal 9.5.x < 9.5.11 / 10.x < 10.0.11 / 10.1.x < 10.1.4 Drupal Vulnerability (SA-CORE-2023-006)
According to its self-reported version, the instance of Drupal running on the remote web server is 9.5.x prior to 9.5.11, 10.x prior to 10.0.11, or 10.1.x prior to 10.1.4. It is, therefore, affected by a vulnerability. - In certain scenarios, Drupal's JSON:API module will output error backtraces...
DRUPAL-CONTRIB-2023-045
This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks...
Mail Login - Critical - Access bypass - SA-CONTRIB-2023-045
This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks...
Drupal 10.1.2 - web-cache-poisoning-External-service-interaction Vulnerability
Title: drupal-10.1.2 web-cache-poisoning-External-service-interaction Author: nu11secur1ty Vendor: https://www.drupal.org/ Software: https://www.drupal.org/download Reference: https://portswigger.net/kb/issues/00300210external-service-interaction-http Description: It is possible to induce the...