Drupal RESTWS Module Remote PHP Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal RESTWS Module Remote PHP Code Execution', 'Description' = %q This module exploits a Remote PHP Code Execution vulnerability in Drupal RESTW...

Drupal Opening Hours Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. opening hours is one of the modules used to find stores or libraries that are open at a certain time. A cross-site scripting vulnerability exists in the Drupal Opening Hours module in...

Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution', 'Description' = %q This module exploits the Drupal RESTWS module...

Drupal Outline Designer Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Outline Designer is one of the user experience modules for library management. A cross-site scripting vulnerability exists in Drupal Outline Designer versions 7.x-2.x prior to 7.x-2.3,...

Drupal RESTWS RCE Vulnerability (SA-CONTRIB-2016-040) - Active Check

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Module RESTWS 7.x - Remote PHP Code Execution (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution', 'Description' = %q Th...

Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)

Drupal Module RESTWS 7.x - PHP Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution',...

Drupal Coder RCE Vulnerability (SA-CONTRIB-2016-039) - Active Check

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; if...

New Relic: XSS in a newrelic.com site

Hello, I found a XSS vulnerability that could be used by an attacker to execute javascript in the client, for example, an attacker could steal the cookie of the user or an attacker could redirect the client to an attacker site and try to exploit vulnerabilities against the browser. Here you can...

Design/Logic Flaw

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP...

Drupal USASearch Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.USASearch is one of the theme search modules. An access bypass vulnerability exists in Drupal USASearch module versions prior to 7.x-5.1, which can be exploited by an attacker to bypass...

Drupal Hubspot CTA module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Hubspot CTA is one of the modules that displays the Hubspot CTA button by creating a Bean block. A cross-site scripting vulnerability exists in the Drupal Hubspot CTA module that can be...

Multiple vulnerabilities in Drupal Node Notify module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Notify is one of the node modules that allows registered users and anonymous users to subscribe. A cross-site scripting vulnerability and a cross-site request forgery vulnerability...

Drupal FileField Module Remote Denial of Service Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.FileField is one of the file upload components that uses the CCK feature extension. A remote denial of service vulnerability exists in versions 6.x-3.x of the Drupal FileField module...

Drupal Google Analytics Counter Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Google Analytics Counter is one of the website traffic analysis modules. A cross-site request forgery vulnerability exists in Drupal Google Analytics Counter versions prior to 7.x-3.2,...

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

More info at https://www.drupal.org/SA-CORE-2016-003...

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

More info at https://www.drupal.org/SA-CORE-2016-003...

Drupal Releases Security Advisory

Drupal has released an advisory to address a vulnerability in Drupal core 8.x versions prior to 8.1.7. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Drupal's Security Advisory and apply the...

Drupal 7.x < 7.44 / 8.1.x < 8.1.3 User Module Account Saving Improper Role Assignment Remote Issue

Binary data 9399.prm...

Drupal RESTWS Module Page Callback RCE

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the bundled RESTful Web services RESTWS module due to a flaw in how default page callbacks for Drupal entities are altered when handling specially crafted requests. An unauthenticated,...