PHPMailer < 5.2.20 Remote Code Execution (0day Patch Bypass/exploit) (CVE-2016-10045)

The Chinese version of the analysis: http://paper.seebug.org/164/ BACKGROUND "PHPMailer continues to be the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily." http://phpmailer.worxware.com/ "Probably the world's most...

3 Critical Zero-Day Flaws Found in PHP 7 — One Remains Unpatched!

Three critical zero-day vulnerabilities have been discovered in PHP 7 that could allow an attacker to take complete control over 80 percent of websites which run on the latest version of the popular web programming language. The critical vulnerabilities reside in the unserialized mechanism in PHP...

PHPMailer Bug Leaves Millions of Websites Open to Attack

UPDATE A critical PHPMailer bug tied to the way websites handle email and feedback forms is leaving millions of websites hosted on popular web-publishing platforms such as WordPress, Drupal and Joomla open to attack. The flaw was disclosed by researcher Dawid Golunski of Legal Hackers, who said t...

Critical PHPMailer Flaw leaves Millions of Websites Vulnerable to Remote Exploit

A critical vulnerability has been discovered in PHPMailer, which is one of the most popular open source PHP libraries to send emails used by more than 9 Million users worldwide. Millions of PHP websites and popular open source web applications, including WordPress, Drupal, 1CRM, SugarCRM, Yii, an...

PHPMailer < 5.2.18 Remote Code Execution Vulnerability

Exploit for php platform in category web applications I. VULNERABILITY ------------------------- PHPMailer 5.2.18 Remote Code Execution II. BACKGROUND ------------------------- "PHPMailer continues to be the world's most popular transport class, with an estimated 9 million users worldwide...

Unspecified Security Bypass Vulnerability in Drupal JavaScript Callback Handler

Drupal is the Drupal community maintained by a set of free , open source content management system developed in PHP language . JavaScript Callback Handler is an efficient Ajax Callback module . An unspecified security bypass vulnerability exists in the Drupal JavaScript Callback Handler module. A...

Updated drupal packages fix security vulnerability

Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...

MGASA-2016-0413 Updated drupal packages fix security vulnerability

Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...

High-performance JavaScript callback handler - Highly Critical - Multiple vulnerabilities - SA-CONTRIB-2016-063

The High-performance JavaScript callback handler module is a light weight callback to bypass most, if not all, of Drupal's bootstrapping process to achieve improved performance. The module does not sufficiently check whether or not a callback is being properly accessed or filtering for potential...

Hashcat v3.20 - World's Fastest and Most Advanced Password Recovery Utility

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 160 highly-optimized hashing algorithms. hashcat currently supports CPU's, GPU's other hardware-accelerators on Linux, Windows and OSX, and has facilities to help enable...

Drupal Elysia Cron Module Arbitrary PHP Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP language maintained by the Drupal community, and Elysia Cron is one of the cron job management modules. An arbitrary PHP code execution vulnerability exists in the Drupal Elysia Cron module. An attacker can exploit the...

Drupal 8.x < 8.2.3 Multiple Vulnerabilites

Binary data 9821.prm...

Fedora 24 : drupal8 (2016-dbbd3d43fe)

8.2.3 Release Notes - Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Drupal 7.x < 7.52 Multiple Vulnerabilites

Binary data 9820.prm...

[SECURITY] Fedora 24 Update: drupal8-8.2.3-1.fc24

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 25 Update: drupal8-8.2.3-1.fc25

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Fedora 25 : drupal8 (2016-411f8b961e)

8.2.3 Release Notes - Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Drupal Multiple Vulnerabilities (Dec 2016) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Fedora 23 : drupal7 (2016-ff9a74c6dc)

https://www.drupal.org/SA-CORE-2016-005 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Drupal Multiple Vulnerabilities (Dec 2016) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...