Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

The Migrate Tools module provides tools for running and managing Drupal migrations. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to trick an authenticated administrator into initiating a migration. This vulnerability is...

PT-2024-10358 · Drupal · Migrate Tools

Name of the Vulnerable Software and Affected Versions: Migrate Tools versions 0.0.0 through 6.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Migrate Tools module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to...

FG Drupal to WordPress < 3.68.0 - Cross-Site Request Forgery via ajax_importer

Description The FG Drupal to WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.67.0. This is due to missing or incorrect nonce validation on the ajaximporter function. This makes it possible for unauthenticated attackers to delete logs...

Drupal 9.3.6 < 9.5.0 DoS Vulnerability - Linux

Drupal is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal 9.3.6 < 9.5.0 DoS Vulnerability - Windows

Drupal is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

WordPress FG Drupal to WordPress Plugin <= 3.67.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software FG Drupal to WordPress Type Plugin Vulnerable versions = 3.67.0 Fixed in 3.68.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24837 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9b60fe7392f5 Credits Friday...

Drupal DoS Vulnerability (SA-CORE-2024-001) - Windows

Drupal is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal DoS Vulnerability (SA-CORE-2024-001) - Linux

Drupal is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

DRUPAL-CONTRIB-2024-007

The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments. It does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities...

Imperva uncovers new Indicators of Compromise for FBI and CISA-flagged AndroxGh0st botnet

On January 16, a joint alert from FBI and CISA warned about a concerning development: the emergence of a botnet driven by AndroxGh0st malware targeting vulnerable applications and web servers. AndroxGh0st is a Python-based malware, first seen in late 2022, designed to target Laravel .env files an...

PT-2024-10361 · Drupal · Drupal Entity Delete Log

Name of the Vulnerable Software and Affected Versions: Drupal Entity Delete Log versions 0.0.0 through 1.1.1 Description: The issue is related to a lack of authorization in the Drupal Entity Delete Log, which allows for forceful browsing. This can enable a remote attacker to bypass security...

Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments. It does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities...

DRUPAL-CONTRIB-2024-006

The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mail handling to the Swift Mailer library. This enables your site to take advantage of the many features which the Swift Mailer library provides. The module could allow an attacker...

DRUPAL-CONTRIB-2024-005

Open Social is a Drupal distribution for online communities. The included optional social\group\flexible\group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content...

DRUPAL-CONTRIB-2024-004

Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed. This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level...

DRUPAL-CONTRIB-2024-003

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that a...

PT-2024-10359 · Drupal · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.04 Description: The issue is related to improper access control in Drupal Open Social, allowing the collection of data from common resource locations. This can be exploited by a remote attacker to bypass...

PT-2024-10089 · Drupal · Drupal Swift Mailer

Name of the Vulnerable Software and Affected Versions: Drupal Swift Mailer versions . Description: The issue is related to an Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer, which allows Resource Location Spoofing. This can be exploited by a remote attacker to perform...

Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

Open Social is a Drupal distribution for online communities. The included optional socialgroupflexiblegroup module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content bein...

PT-2024-10091 · Drupal · Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Two-factor Authentication TFA versions 0.0.0 through 1.5.0 Description: The issue is related to a weak authentication vulnerability in the Two-factor Authentication TFA module for Drupal, which can be exploited to abuse authentication. This...