CrimeOps of the KashmirBlack Botnet – Part I

Introduction Being in a research team exposes us to a variety of attacks on different platforms, of different types, scope, and volume. It also gives us the opportunity to select particularly interesting attacks that target our customers and to analyze them. This blog will give you a taste of the...

Exploit for Improper Input Validation in Joomla Joomla\!

CMS-Hunter 简介 Content Management System Vulnerability Hunter 说明：目前来看，本项目会进行长期维护，有修改的建议或者想法欢迎联系作者。 CMS 漏洞列表 Discuz - Discuz＜3.4birthprovince前台任意文件删除 DedeCMS - DedeCMSv5.7shopsdelivery存储型XSS - DedeCMSv5.7carbuyaction存储型XSS - DedeCMSv5.7友情链接CSRFGetShell - DedeCMS V5.7 SP2后台存在代码执行漏洞 Drupal -...

CentOS 7 : ipa (RHSA-2020:3936)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3936 advisory. - jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option,...

FreeBSD : drupal -- Multiple Vulnerabilities (95d9d986-1078-11eb-ab74-4c72b94353b5)

Drupal Security Team reports : The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrin...

DRUPAL-CONTRIB-2020-034

This module enables you login into any OAuth 2.0 compliant application using Drupal credentials. The 8.x branch of the module is vulnerable to SQL injection...

Drupal OAuth Server ( OAuth / OIDC Provider) - Single Sign On ( SSO ) - Moderately critical - SQL Injection - SA-CONTRIB-2020-034

This module enables you login into any OAuth 2.0 compliant application using Drupal credentials. The 8.x branch of the module is vulnerable to SQL injection...

The vulnerability of the Drupal CMS system, related to insufficient verification of the authenticity of executed queries, allows a hacker to execute arbitrary code.

The vulnerability of the Drupal CMS system is related to insufficient verification of the authenticity of executed queries. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...

Security Bulletin: IBM API Connect is vulnerable to cross-site request forgery (CSRF) (CVE-2020-13663)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13663 DESCRIPTION: Drupal core is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input by the Form API. By persuading an authenticated user to visit a...

Exploit for SQL Injection in Drupal

vulnerability-list 常见漏洞快速检测，目前包含以下漏洞。 Tomcat： - CVE201712615 / CVE201712617 - tomcatweakpassword - examplevulnerability检测tomcat的examples等目录是否存在 moon.py -u tomcat http://xx.xx.xx.xx:xxxx Fckeditor - 获取版本及常见上传页面检测 - fck moon.py -u fck http://xx.xx.xx.xx/fckxx Weblogic - CVE201710271...

CMSmap

This is a Python-based CMS Content Management System scanner called CMSmap. It is designed to automate the process of detecting security flaws in popular CMSs such as WordPress, Joomla, Drupal, and Moodle. The tool is still in its early stages and may contain bugs or flaws. The tool uses a...

Fedora: Security Advisory for drupal7 (FEDORA-2020-fe94df8c34)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for drupal8 (FEDORA-2020-eb137c7eda)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 33 Update: drupal7-7.72-1.fc33

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 33 Update: drupal8-8.9.5-1.fc33

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Drupal 7.x < 7.73 / 8.8.x < 8.8.10 / 8.9.x < 8.9.6 / 9.0.x < 9.0.6 XSS (drupal-2020-09-16)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, or 9.0.x prior to 9.0.6. It is, therefore, affected by a cross-site scripting XSS vulnerability in the AJAX API component due to...

Drupal 8.8.x < 8.8.10 / 8.9.x < 8.9.6 / 9.0.x < 9.0.6 Multiple Vulnerabilities (drupal-2020-09-16)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, or 9.0.x prior to 9.0.6. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in the File module. An...

Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Vault previously known as IBM Security Secret Server

Summary Multiple vulnerabilities identified in IBM Security Verify Privilege Vault previously known as IBM Security Secret Server have been addressed in the release 10.9. Vulnerability Details CVEID: CVE-2020-4324 DESCRIPTION: IBM Security Secret Server could allow a remote attacker to bypass...

Drupal core cross-site scripting vulnerability (CNVD-2020-65151)

Drupal core is a free, open source content management system developed in PHP by the Drupal community. A cross-site scripting vulnerability exists in Drupal core. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

HackerOne: Reflected XSS on www.hackerone.com via Wistia embed code

Summary: The HackerOne marketing site uses Wistia to host and embed videos using html snippets similar to the following: html The issue is that the E-v1.js script is vulnerable to prototype pollution when setting up the logging, via both the url and the document referrer: javascript...

Cross-site Scripting (XSS)

drupal7 is vulnerable to cross-site scripting XSS. Due to lack of proper sanitization of user-provided data, an attacker can inject arbitrary html and script code into the web site...