Symfony Flaw Leaves Drupal Sites Vulnerable to Hackers—Patch Now

It's time to update your Drupal websites. Drupal, the popular open-source content management system, has released a new version of its software to patch a security bypass vulnerability that could allow a remote attacker to take control of the affected websites. The vulnerability, tracked as...

Drupal Core Multiple Security Vulnerabilities (SA-CORE-2018-005) - Linux

Drupal is prone to multiple security vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Drupal Core Multiple Security Vulnerabilities (SA-CORE-2018-005) - Windows

Drupal is prone to multiple security vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Drupal Releases Security Update

Drupal has released a security update addressing a vulnerability in Drupal 8.x. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review Drupal's Security Advisory and apply the necessary update. This product is...

Drupal Core - 3rd-party libraries -SA-CORE-2018-005

The Drupal project uses the Symfony library. The Symfony library has released a security update that impacts Drupal. Refer to the Symfony security advisory for the issue. The same vulnerability also exists in the Zend Feed and Diactoros libraries included in Drupal core; however, Drupal core does...

CVE-2018-14773: Remove support for legacy and risky HTTP headers

Affected versions Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43, 3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13 and 4.1.0 to 4.1.2 versions of the Symfony HttpFoundation component are affected by this security issue. The issue has been fixed in Symfony 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, and...

Drupal Core - 3rd-party libraries -SA-CORE-2018-005

The Drupal project uses the Symfony library. The Symfony library has released a security update that impacts Drupal. Refer to the Symfony security advisory for the issue. The same vulnerability also exists in the Zend Feed and Diactoros libraries included in Drupal core; however, Drupal core does...

Zero-Day Coverage Update – Week of July 23, 2018

We’re at the end of July and the Zero Day Initiative ZDI has published 873 advisories so far. That’s 273 advisories this month alone – and that’s just the tip of the iceberg! Earlier this week, ZDI announced the Targeted Incentive Program, which brings over $1,500,000 USD in special bounty awards...

Staying Safe in the Era of Browser-based Cryptocurrency Mining

Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...

Select (or other) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-054

This module enables users to select 'other' on certain form elements and a textfield appears for the user to provide a custom value. The module doesn't sufficiently escape values of a text field the under the scenario when "Select or other" formatter is used. This vulnerability is mitigated by th...

@yihangho/express-admin (1.3.2-2), analyst (>=0.0.3, <=0.0.8) +58 more potentially affected by CVE-2017-16082 via pg (>=2.0.0, <=2.11.1)

pg NPM version =2.0.0, =0.0.3, =0.1.0, =0.0.1, =0.0.62, =0.0.1, =0.0.1, =1.0.1, =0.0.1, =0.1.0, =0.0.1, =0.0.3 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

detentejardin.com XSS vulnerability

Open Bug Bounty ID: OBB-652969 Description| Value ---|--- Affected Website:| detentejardin.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Drupal Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

maisoncreative.com XSS vulnerability

Open Bug Bounty ID: OBB-652968 Description| Value ---|--- Affected Website:| maisoncreative.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Drupal Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

regal.fr XSS vulnerability

Open Bug Bounty ID: OBB-652967 Description| Value ---|--- Affected Website:| regal.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Drupal Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CMSeeK v1.0.5 - CMS Detection And Exploitation Suite

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.5 19-07-2018 - Version 1.0.4...

Newsmaker Interview: Troy Mursch on Why Cryptojacking Isn’t Going Away

Cyber criminals have seen a golden opportunity in the meteoric rise of cryptocurrencies over the past year. They are harnessing devices – from laptops, to desktops, all the way up to servers – to mine cryptocurrencies such as Bitcoin or Monero. This malicious move, dubbed by some researchers as...

CVE-2018-7602

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

CVE-2018-7602

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

UBUNTU-CVE-2018-7602

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

CVE-2018-7602

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...