14468 matches found
Symlink Attack
drupal/drupal is vulnerable to symlink attacks. The application uses a third-party library ArchiveTar that allows symbolic links by default. When Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads, an attacker is able to upload compressed files containing malicious filenames...
Authorization Bypass
drupal/drupal is vulnerable to authorization bypass. Lack of restriction to media items in the Media Library allows an attacker to bypass authorization in specific configurations of Drupal...
Authorization Bypass
drupal/drupal is vulnerable to authorization bypass. The filesaveupload function does not strip the leading and trailing dot . characters from filenames. Any users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system...
FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (3da0352f-2397-11ea-966e-000ffec0b3e1)
Drupal Security Team reports : A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt. Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with t...
The vulnerability of the Phar utility in the Drupal CMS system allows a hacker to execute arbitrary code.
The vulnerability of the phar utility in the Drupal CMS system is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file with the .phar extension...
The vulnerability of the PEAR Archive_Tar library in the Drupal CMS system allows a hacker to execute arbitrary code.
The vulnerability of the PEAR ArchiveTar library in the Drupal CMS system is related to the restoration of a dubious data structure in memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
Drupal 7.0.x < 7.69 / 8.7.x < 8.7.11 / 8.8.x < 8.8.1 Multiple Vulnerabilities (drupal-2019-12-18)
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.69, 8.7.x prior to 8.7.11, or 8.8.x prior to 8.8.1. It is, therefore, affected by multiple vulnerabilities. - The Drupal project uses the third-party library ArchiveTar, which has...
Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw
If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...
Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw
If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...
Drupal Releases Security Updates
Drupal has released security updates to address vulnerabilities in Drupal 7.x, 8.7.x, and 8.8.x. An attacker could exploit some of these vulnerabilities to modify data on an affected website. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review t...
Drupal 8.x Multiple Vulnerabilities (SA-CORE-2019-009, SA-CORE-2019-010, SA-CORE-2019-011) - Linux
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Drupal 7.x and 8.x Multiple Vulnerabilities (SA-CORE-2019-012) - Linux
Drupal is prone to multiple vulnerabilities in the third-party library ArchiveTar. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Drupal 8.x Multiple Vulnerabilities (SA-CORE-2019-009, SA-CORE-2019-010, SA-CORE-2019-011) - Windows
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Drupal 7.x and 8.x Multiple Vulnerabilities (SA-CORE-2019-012) - Windows
Drupal is prone to multiple vulnerabilities in the third-party library ArchiveTar. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
DRUPAL-CORE-2019-012
The Drupal project uses the third-party library Archive\Tar, which has released a security improvement that is needed to protect some Drupal configurations. Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them. The late...
DRUPAL-CORE-2019-011
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations...
DRUPAL-CORE-2019-010
Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to...
DRUPAL-CORE-2019-009
A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...
isos.com Cross Site Scripting vulnerability
Security Researcher SkypLabs Helped patch 13 vulnerabilities Received 1 Coordinated Disclosure badges Received 2 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting isos.com website and its users. Following coordinated and...
