14567 matches found
CAPTCHA - Moderately Critical - Denial of Service - SA-CONTRIB-2017-073
This module enables you to use various techniques to block automated scripts / robots from submitting content to a site, e.g. to block spam comments. The module doesn't properly store the session ID of visitors who are given a session which could lead to a Denial of Service attack. This...
H5P - Critical - Reflected Cross Site Scripting (XSS) - DRUPAL-SA-CONTRIB-2017-071
The H5P module helps create interactive videos, question sets, drag and drop questions, multichoice questions, boardgames, presentations, flashcards and more using Drupal. The module does not sufficiently filter text prior to printing it back to the page, leading to a Reflected Cross Site Scripti...
Commerce invoices - Highly Critical - SQL Injection and Cross Site scripting - DRUPAL-SA-CONTRIB-2017-070
Commerce Invoices allows you to enter an Invoice number, Company name and Amount and it will generate an Invoice that the client can pay on your site using any payment method supported by Drupal commerce. SQL Injection The module did not properly use Drupal's database API when querying the databa...
Comission - WhiteBox CMS Analysis
CoMisSion is a tool to quickly analyze a CMS setup. The tool: checks for the core version; looks for the last core version; looks for vulnerabilities in core version used; checks for plugins version; looks for vulnerabilities in plugins version used; A complete report can be generated in XLSX or...
Multiple Unspecified Vulnerabilities in Drupal Session Cache API Module
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Multiple unspecified vulnerabilities exist in the Drupal Session Cache API module. No details of the vulnerabilities are available at this time...
Drupal Relation Module Access Bypass Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Relation module. An attacker could use the vulnerability to bypass certain security restrictions and perform unauthoriz...
Drupal Better Field Descriptions Module Cross-Site Scripting Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Better Field Descriptions Module due to an inability to properly clean user-supplied input. An attacker can explo...
Drupal Facebook Like Button Module DRUPAL-SA-CONTRIB-2017-066 Cross-Site Scripting Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Facebook Like Button module DRUPAL-SA-CONTRIB-2017-066 due to the program failing to properly filter user-supplie...
Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...
Drupal Views access bypass vulnerability (CNVD-2017-221665)
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views is one of the view components. An access bypass vulnerability exists in Drupal Views versions prior to 7.x-3.17. An attacker can exploit this vulnerability to bypass security...
CoMisSion: Open Source WhiteBox CMS Analysis Tool
PenTestIT RSS Feed Less than a week ago, an open source white-box CMS analysis tool was released - CoMisSion. I had covered a similar local web application vulnerability scanner - pyfiscan. This new tool tends to automate a lot of tasks that help you analyze a CMS setup and tend to be long, tedio...
Drupal Views Refresh Security Bypass Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views Refresh is one of the page view refresh modules. A security bypass vulnerability exists in Drupal Views Refresh versions prior to 7.x-1.2. A remote attacker can exploit this...
FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)
Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...
Drupal Patches Critical Access Bypass Bug
Website management platform Drupal released several patches that address access bypass vulnerabilities in its Drupal 8 Core engine Wednesday, fixing one critical and two moderately critical security bugs. The most serious of the vulnerabilities is the access bypass vulnerability CVE-2017-6925 in...
Drupal REST API Security Bypass Vulnerability
Drupal core is a free, open source content management system developed in PHP and maintained by the Drupal community. A security bypass vulnerability exists in version 8.x of the Drupal REST API prior to 8.3.7. An attacker can exploit this vulnerability to bypass security restrictions and perform...
Drupal Entity Access Bypass Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in version 8.x of Drupal Entity prior to 8.3.7. An attacker can exploit this vulnerability to bypass security restrictions and perfor...
Drupal Views Access Bypass Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views is one of the view components. An access bypass vulnerability exists in version 8.x of Drupal Views prior to 8.3.7. An attacker could use this vulnerability to bypass security...
Drupal Core Multiple Vulnerabilities (SA-CORE-2017-004) - Windows
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Drupal Core Multiple Vulnerabilities (SA-CORE-2017-004) - Linux
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
