Simple Taxonomy Revision - Critical - Unsupported - SA-CONTRIB-2018-025

Simple Taxonomy Revision module enables revisions for taxonomy terms for Drupal 8. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read:...

Multi-Step Registration - Critical - Unsupported Module - SA-CONTRIB-2018-023

With Multi-Step Registration you can create multi-step wizard user account registration forms. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read:...

KCFinder integration - Critical - Unsupported Module - SA-CONTRIB-2018-024

KCFinder is a multi-language file / image manager you can use to easily select, insert, upload and arrange images, flash movies, and other kinds of files. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintaine...

400 popular Drupal based websites hacked to mine cryptocurrency

By Waqas Vulnerability in Drupal CMS Converted Popular Websites into Monero mining This is a post from HackRead.com Read the original post: 400 popular Drupal based websites hacked to mine cryptocurrency...

Drupal 7 SA-CORE-2018-004 RCE

Remote command execution vulnerability in Drupal Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Drupal 8 SA-CORE-2018-002 RCE

Remote command execution vulnerability in Drupal core/lib/Drupal/Core/DrupalKernel.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Drupal 7 SA-CORE-2018-002 RCE

Remote command execution vulnerability in Drupal core/lib/Drupal/Core/DrupalKernel.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

viewsvn.robloach.net XSS vulnerability

Open Bug Bounty ID: OBB-613599 Description| Value ---|--- Affected Website:| viewsvn.robloach.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cryptojacking Campaign Exploits Drupal Bug, Over 400 Websites Attacked

UPDATE – Hundreds of websites running on the Drupal content management system – including those of the San Diego Zoo and the National Labor Relations Board – have been targeted by a malicious cryptomining campaign taking advantage of unpatched and recently revealed vulnerabilities. The attacks,...

Drupwn - Drupal Enumeration & Exploitation Tool

Drupwn claims to provide an efficient way to gather drupal information. Further explaination on blog post article Supported tested version Drupal 7 Drupal 8 Execution mode Drupwn can be run, using two seperate modes which are enum and exploit. The enum mode allows performing enumerations whereas...

ylang-ylang.uninorte.edu.co Improper Access Control vulnerability

Open Bug Bounty ID: OBB-612648 Description| Value ---|--- Affected Website:| ylang-ylang.uninorte.edu.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

[SECURITY] Fedora 28 Update: drupal7-7.59-1.fc28

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 30, 2018

When I was little, I discovered the joy of jumping on the bed. While it was fun to jump on the bed, I wanted to make it more challenging so I started to imitate the ski jumpers I had seen during the 1976 Winter Olympics and jump from my parents’ dresser to the bed. I quickly found out there’s a...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (89ca6f7d-4f00-11e8-9b1d-00e04c1ea73d)

Drupal Security Team reports : A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to...

Kitty Cryptomining Malware Cashes in on Drupalgeddon 2.0

Yet another bad actor has taken advantage of Drupal sites still vulnerable to “Drupalgeddon 2.0,” this time to mine cryptocurrency. The bad script, dubbed the “Kitty” cryptomining malware, takes advantage of the known critical remote-code execution vulnerability in Drupal CVE-2018-7600 to target...

Drupal < 7.58 - Drupalgeddon3 Authenticated Remote Code Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupalgeddon3', 'Description' = %q CVE-2018-7602 / SA-CORE-2018-004 A remote code execution...

Drupalgeddon3 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupalgeddon3', 'Description' = %q CVE-2018-7602 / SA-CORE-2018-004 A remote code execution vulnerability exists within multiple subsystems of...

Drupal 7.58 - Drupalgeddon3 (Authenticated) Remote Code (Metasploit)

Drupal 7.58 - Drupalgeddon3 Authenticated Remote Code Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupalgeddon3', 'Description' = %q CVE-2018-7602 / SA-CORE-2018-004 A remote cod...

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupalgeddon3', 'Description' = %q CVE-2018-7602 / SA-CORE-2018-004 A remote code execution vulnerability exists within multiple subsystems of...

[SECURITY] Fedora 28 Update: drupal8-8.4.6-3.fc28

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...