CVE-2013-4226

The CVE-2013-4226 entry concerns the Drupal Authenticated User Page Caching (authcache) module. Affected component: authcache 7.x-1.x prior to 7.x-1.5. Root cause: the module does not properly restrict access to cached pages, enabling remote attackers with the same role-combination as the superus...

CVE-2013-4226

The Authenticated User Page Caching Authcache module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the superuser...

CVE-2013-4228

The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...

CVE-2013-4228

CVE-2013-4228 affects the Drupal contributed module Organic Groups (OG) for 7.x-2.x prior to 7.x-2.3. The vulnerability arises from the OG access/visibility fields not properly restricting access to private groups, allowing remote authenticated users to guess node IDs, subscribe to, and read cont...

CVE-2013-4227

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

CVE-2013-4227

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

CVE-2013-4227

The CVE affects Drupal with the Mozilla Persona module (7.x-1.x) prior to 7.x-1.11. A CSRF flaw exists in the persona_xsrf_token function where a security token not typed as a string can be accepted, enabling an attacker to hijack a user’s authentication. Root cause: token handling in persona_xsr...

NekoBot - Auto Exploiter With 500+ Exploit 2000+ Shell

NekoBotV1 | Auto Exploiter With 500+ Exploit 2000+ Shell Features : + Wordpress : 1- Cherry-Plugin 2- download-manager Plugin 3- wysija-newsletters 4- Slider Revolution Revslider 5- gravity-forms 6- userpro 7- wp-gdpr-compliance 8- wp-graphql 9- formcraft 10- Headway 11- Pagelines Plugin 12-...

CVE-2013-4225

The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...

Cross site scripting

The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...

CVE-2013-4225

The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...

CVE-2013-4225

The RESTful Web Services (RESTWS) module for Drupal is vulnerable in versions 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 due to insufficient restriction of access to entity write operations. This allows remote authenticated users with permissions such as "access resource node" and "create ...

drupal.okeyno.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1089677 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

HackerOne: 404-response contains debug-information with all headers

Summary: When requesting a page that does not exist under www.hackerone.com the page returns a hidden HTML-element debugData that reflects all headers in the GET-request, including http-only cookies. Description: This in itself is not a serious vulnerablity, but as the program description mention...

The vulnerability of the handlers/views_handler_filter_dynamic_fields.inc component in the Drupal Views Dynamic Fields module allows a hacker to execute arbitrary code.

The vulnerability of the handlers/viewshandlerfilterdynamicfields.inc component in the Drupal “Views Dynamic Fields” module is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code...

PT-2020-7484 · Drupal · Drupal Restws Module

Name of the Vulnerable Software and Affected Versions: Drupal restws module versions 7.x-1.x before 7.x-1.4 Drupal restws module versions 7.x-2.x before 7.x-2.1 Description: The issue allows remote authenticated users with certain permissions, such as access resource node and create page content,...

Drupal Data Cross-Site Scripting Vulnerability

Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal version 6.20, Data 6.x-1.0-alpha14. The vulnerability stems from a lack of proper validation of client-side data by the WEB applicatio...

Drupal Data SQL Injection Vulnerability

Drupal is an open source content management system developed by the Drupal community using the PHP language. A SQL injection vulnerability exists in Drupal version 6.20, Data 6.x-1.0-alpha14. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...

CVE-2012-5570

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...