Webform - Moderately critical - Access bypass - SA-CONTRIB-2021-004

The Webform module for Drupal 8/9 includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form. The confirmation email can be used as an open mail relay to send an email to any email address. This...

Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2021-1346)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : pki-core (EulerOS-SA-2021-1346)

According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Dogtag PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. PKI consists of the following...

CMSmap

It is an offensive tool for web application security testing. The primary CVE ID is not present in the provided context. The target product/service or framework is not explicitly stated, but the tool appears to be designed for testing popular Content Management Systems CMSs such as WordPress,...

The vulnerability of the Drupal CMS system’s kernel allows a hacker to execute arbitrary code and take control of the website.

The vulnerability of the Drupal CMS system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and take control of the website through a specially crafted HTTP request...

Security Bulletin: IBM API Connect's Developer Portal is vulnerable to arbitrary code excution in Drupal Core (CVE-2020-13671)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13671 DESCRIPTION: Drupal Core could allow a remote attacker to execute arbitrary code on the system, caused by the failure to properly sanitize certain filenames on uploaded files. By...

Security Bulletin: IBM API Connect's Developer Portal is impacted by multiple vulnerabilities in Drupal core.

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13669 DESCRIPTION: Drupal core is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the built-in CKEditor image caption functionality. A remote...

DRUPAL-CONTRIB-2021-002

The Social User Export module enables users within Open Social to create an export of users and download this to a CSV file. The module doesn't sufficiently check access when building the CSV file, allowing logged-in users without the manage members permission to be able to export all data from a...

Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Windows

Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Linux

Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal 8.9.x < 8.9.13 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 7.x < 7.78 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 9.1.x < 9.1.3 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 9.0.x < 9.0.11 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal Releases Security Updates

Drupal has released security updates to address a vulnerability affecting Drupal. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Drupal Advisory SA-CORE-2021-001 and apply the necessary updates or mitigations...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal. A malicious party could potentially exploit the vulnerability to execute arbitrary PHP code execute under the application's permissions. To do so, the malicious party needs to upload a rogue .tar, .tar.gz, .bz2, or .tlz file uploaded to the Drupal server...

DLA-2530-1 drupal7 - security update

Bulletin has no description...

VulnCheck KEV: CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

DRUPAL-CORE-2021-001

The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...

Drupal core - Critical - Third-party libraries - SA-CORE-2021-001

The Drupal project uses the pear ArchiveTar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...