Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025

The Admin Toolbar admintoolbar module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work. The Admin Toolbar Search sub-module of this module doesn't sanitize user input in certain cases, which leads to a...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal (CVE-2021-33829)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-33829 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious...

Security Bulletin: IBM API Connect is impacted by a cross site scripting vulnerability in Drupal core SA-CORE-2021-002

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details Third Party Entry: 200544 DESCRIPTION: Drupal core is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the sanitization API. A remote authenticated attacker could...

Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems

Close to 14 million Linux-based systems are directly exposed to the Internet, making them a lucrative target for an array of real-world attacks that could result in the deployment of malicious web shells, coin miners, ransomware, and other trojans. That's according to an in-depth look at the Linu...

Drupal 8.9.x < 8.9.18, 9.x < 9.1.12, 9.2.x < 9.2.4 Multiple CKEditor Library Vulnerabilities (SA-CORE-2021-005) - Windows

Drupal is prone to a vulnerability in the third-party library CKEditor. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal. A malicious party can exploit the vulnerability to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application is visited. The vulnerability is located in the...

Drupal 8.9.x < 8.9.18, 9.x < 9.1.12, 9.2.x < 9.2.4 Multiple CKEditor Library Vulnerabilities (SA-CORE-2021-005) - Linux

Drupal is prone to a vulnerability in the third-party library CKEditor. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

DRUPAL-CORE-2021-005

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content even without...

Drupal Releases Security Updates

Drupal has released security updates to address vulnerabilities that could affect versions 8.9, 9.1, and 9.2. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Drupal Security Advisory SA-CORE-2021-005 and app...

Drupal 8.9.x < 8.9.18 / 9.1.x < 9.1.12 / 9.2.x < 9.2.4 Multiple Vulnerabilities (SA-CORE-2021-005)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.18, 9.1.x prior to 9.1.12, or 9.2.x prior to 9.2.4. It is, therefore, affected by a multiple vulnerabilities due to its usage of a third party component, CKEditor, for WYSIWYG...

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content even without...

DRUPAL-CONTRIB-2021-024

This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The administration routes used by the project lacked proper permissions, allowing untrusted users to access, create and modify the module's settings...

elFinder 路径遍历漏洞

elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling, and other features. A path traversal vulnerability exists in elFinder AspNet that does not properly eliminate a file system path before creating it using a...

Drupal 7.x < 7.82 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.82, 8.9.x prior to 8.9.17, 9.1.x prior to 9.1.11 or 9.2.x prior to 9.2.2. It is, therefore, affected by a vulnerability due to the PEAR ArchiveTar library used by Drupal. The Drupal...

Drupal 8.9.x < 8.9.17 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.82, 8.9.x prior to 8.9.17, 9.1.x prior to 9.1.11 or 9.2.x prior to 9.2.2. It is, therefore, affected by a vulnerability due to the PEAR ArchiveTar library used by Drupal. The Drupal...

Drupal 9.1.x < 9.1.11 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.82, 8.9.x prior to 8.9.17, 9.1.x prior to 9.1.11 or 9.2.x prior to 9.2.2. It is, therefore, affected by a vulnerability due to the PEAR ArchiveTar library used by Drupal. The Drupal...

Drupal 9.2.x < 9.2.2 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.82, 8.9.x prior to 8.9.17, 9.1.x prior to 9.1.11 or 9.2.x prior to 9.2.2. It is, therefore, affected by a vulnerability due to the PEAR ArchiveTar library used by Drupal. The Drupal...

DLA-2721-1 drupal7 - security update

Bulletin has no description...

Exploit for Code Injection in Drupal

Drupal 远程代码执行漏洞（CVE-2018-7602） 影响软件：drupal 方式：对URL中的进行编码两次，绕过sanitize函数过滤 效果：任意命令执行 漏洞环境 执行如下命令启动drupal 7.57的环境： bash docker-compose up -d 环境启动后，访问 http://your-ip:8081/ 将会看到drupal的安装页面，一路默认配置下一步安装。因为没有mysql环境，所以安装的时候可以选择sqlite数据库。 漏洞复现 参考pimps/CVE-2018-7600的PoC。 如下图所示，执行以下命令即可复现该漏洞。示例命令为...

Drupal 7.x < 7.82, 8.0.x < 8.9.17, 9.x < 9.1.11, 9.2.x < 9.2.2 Archive_Tar library Vulnerability (SA-CORE-2021-004) - Linux

Drupal is prone to a vulnerability in the third-party library ArchiveTar. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...