[SECURITY] Fedora 32 Update: drupal7-ckeditor-1.19-1.fc32

This module will allow Drupal to replace textarea fields with the CKEditor - a visual HTML editor 1, usually called a WYSIWYG editor. This HTML text edi tor brings many of the powerful WYSIWYG editing functions of known desktop edit ors like Word to the web. It's very fast and doesn't require any...

Drupal 7.x < 7.13 Multiple Vulnerabilities

The remote web server is running a PHP application that is affected by a cross-site request forgery vulnerabilit. A csrf vulnerability exists allowing remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. CVE-2007-6752...

FreeBSD : drupal -- Drupal Core - Moderately critical - Third-party library (e24fd421-8128-11ea-aa57-000ffec73f06)

Drupal Security Team reports : The Drupal project uses the third-party library CKEditor, which has released a security improvement that is needed to protect some Drupal configurations. Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. An...

Malicious Package

Overview capistrano3drupal is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview drupal-fu is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using drupal-fu...

DRUPAL-CONTRIB-2020-010

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The security team and module maintainers are marking this project unsupported. Both the 8.x-1.x and 8.x-2.x versions are unsupported, and users of either version are...

JSON:API - Critical - Unsupported - SA-CONTRIB-2020-010

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The security team and module maintainers are marking this project unsupported. Both the 8.x-1.x and 8.x-2.x versions are unsupported, and users of either version are...

Security Bulletin: A vulnerability in jQuery affects the IBM Performance Management product (CVE-2019-11358)

Summary jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An...

Fedora 30 : drupal7-ckeditor (2020-e653bca022)

https://www.drupal.org/project/ckeditor/releases/7.x-1.19 - https://www.drupal.org/sa-contrib-2020-007 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as...

[SECURITY] Fedora 30 Update: drupal7-ckeditor-1.19-1.fc30

This module will allow Drupal to replace textarea fields with the CKEditor - a visual HTML editor 1, usually called a WYSIWYG editor. This HTML text edi tor brings many of the powerful WYSIWYG editing functions of known desktop edit ors like Word to the web. It's very fast and doesn't require any...

enfocus.com Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-1138841 Security Researcher Manojkhd Helped patch 44 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting enfocus.com website and its users. Following coordinate...

Spamicide - Critical - Access bypass - SA-CONTRIB-2020-009

The Spamicide module protects Drupal forms with a form field that is hidden from normal users, but visible to spam bots. The module doesn't require appropriate permissions for administrative pages leading to an Access Bypass...

Exploit for Improper Input Validation in Drupal

It is an exploit module/toolkit targeting Drupal, specifically e...

Fedora: Security Advisory for drupal8 (FEDORA-2020-e62856911b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 32 Update: drupal8-8.8.4-1.fc32

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 30 Update: drupal8-8.8.4-1.fc30

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 31 Update: drupal8-8.8.4-1.fc31

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Drupal 5.x < 5.11 / 6.x < 6.5 Multiple Vulnerabilities (SA-2008-060)

The version of Drupal running on the remote web server is 5.x prior to 5.11 or 6.x prior to 6.5. It is, therefore, affected by the following vulnerabilities: - The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote, authenticated users to bypass intended...

Drupal 8.7.x < 8.7.12 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 8.7.x prior to 8.7.12, or 8.8.x prior to 8.8.4. It is, therefore, affected by a cross-site scripting vulnerability. Drupal uses the third-party library CKEditor, which is vulnerable to a cross-site...

Drupal 8.8.x < 8.8.4 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 8.7.x prior to 8.7.12, or 8.8.x prior to 8.8.4. It is, therefore, affected by a cross-site scripting vulnerability. Drupal uses the third-party library CKEditor, which is vulnerable to a cross-site...