Drupal Core stream wrapper Insecure Deserialization (CVE-2019-6339)

An insecure deserialization vulnerability exists in Drupal Core. The vulnerability is in a stream wrapper when performing file operations. Successful exploitation of this vulnerability could result in arbitrary code execution under the security context of the web server...

[SECURITY] Fedora 30 Update: drupal8-8.6.13-1.fc30

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 30 Update: drupal7-7.65-1.fc30

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

FreeBSD : drupal -- Drupal core - Moderately critical - XSS (94d63fd7-508b-11e9-9ba0-4c72b94353b5)

Drupal Security Team reports : Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Cross-site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of validation of UTF8 on the filename, allowing a remote attacker to inject arbitrary Javascript into a victim's browser...

Module Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2019-042

This module enables you to filter the list of modules on the admin modules page, and organizes packages into vertical tabs. The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that the...

Drupal cross-site scripting vulnerability (CNVD-2019-12155)

Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal version 7 prior to 7.65, version 8.6 prior to 8.6.13, and version 8.5 prior to 8.5.14, which stems from a lack of proper validation of...

CVE-2019-6341

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

CVE-2019-6341

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

Cross site scripting

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

CVE-2019-6341

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

UBUNTU-CVE-2019-6341

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

CVE-2019-6341 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

CVE-2019-6341

Drupal core File module allows stored cross-site scripting due to improper handling of the filename parameter during uploads. Affected versions are Drupal 7 prior to 7.65; Drupal 8.6 prior to 8.6.13; Drupal 8.5 prior to 8.5.14. Exploitation could lead to executing arbitrary script code in the con...

CVE-2019-6341

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability...

Plugin vulnerabilities exploited in traffic monetization schemes

In their Website Hack Trend Report, web security company Sucuri noted that WordPress infections rose to 90 percent in 2018. One aspect of Content Management System CMS infections that is sometimes overlooked is that attackers not only go after the CMSes themselves—WordPress, Drupal, etc.—but also...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting XSS vulnerability. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: XSS always requires extra effort in a pentest, it depends on the actual app...

Drupal File file_create_filename Persistent Cross-Site Scripting Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Drupal. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the...

PT-2019-1889

Name of the Vulnerable Software and Affected Versions jQuery versions 1.1.4 through 3.4.0 Description The issue is related to the jQuery.extend function, which mishandles the proto property, allowing an attacker to exploit Object.prototype pollution. This could lead to a denial of service,...

Drupal 8.5.x < 8.5.8 / 8.6.x < 8.6.2 Open Redirect

The instance of Drupal running on the remote web server is affected by an open redirect vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to redirect a victim from an intended legitimate website to an arbitrary website, thereby exposing the users to...