16061 matches found
Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001
File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical A vulnerability exists in the File module that allows a malicious user to view, delete or substitute a link to a file that the victim has uploaded to a form while the form has not yet been submitted...
Drupal 8.0.x-dev Cross Site Scripting
DOM Based XSS with character on IE8 and older versions IMPORTANT: this issue has been cleared for public discussion and resolution by the Drupal Security Team based on the low evidence of vulnerable browsers still existing. Problem/Motivation filterxss does not filter out the accent grave...
Joomla Joins WordPress As TeslaCrypt Ransomware Target
Exploit kits infecting thousands of WordPress websites are setting their sights on the open-source content management system Joomla in a new campaign spotted by a researcher at the SANS Institute’s Internet Storm Center. “The group behind the WordPress ‘admedia’ campaign is now apparently targeti...
Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass - DRUPAL-SA-CONTRIB-2016-006
This module enables you to make credit card payments for Drupal Commerce orders via the Authorize.Net payment gateway using either their SIM hosted payment page or DPM direct post method mechanisms. The module doesn't sufficiently protect against the premature triggering of order completion witho...
Nodejs - Access bypass - Moderately Critical -- DRUPAL-SA-CONTRIB-2016-007
This module provides an API that other modules can use to add realtime capabilities to Drupal, specifically enabling pushing updates to open connected clients. The module doesn't disconnect unauthenticated sockets, allowing those sockets to receive broadcast messages. For sites that only serve...
VK.com: vk.com/login.php
Выполнив 3 простейших шага, и Вы столкнётесь с отказом сервера что-либо делать. Шаг 1: Перейти по адресу vk.com/login.php Шаг 2: Ввести в поле "логин" символы 00 или 000 или 0000, и так до 17 нулей, пароль указать любой. Шаг 3: Нажать логин и сервер будет сильно недоволен. Спасибо, и исправьте св...
Email address can be matched to an account
More info at https://www.drupal.org/SA-CORE-2016-001...
Session data truncation can lead to unserialization of user provided data
More info at https://www.drupal.org/SA-CORE-2016-001...
Brute force amplification attacks via XML-RPC
More info at https://www.drupal.org/SA-CORE-2016-001...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-001...
Form API ignores access restrictions on submit buttons
More info at https://www.drupal.org/SA-CORE-2016-001...
Form API ignores access restrictions on submit buttons
More info at https://www.drupal.org/SA-CORE-2016-001...
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via double-encoded 'destination' parameter
More info at https://www.drupal.org/SA-CORE-2016-001...
Reflected file download vulnerability
More info at https://www.drupal.org/SA-CORE-2016-001...
Email address can be matched to an account
More info at https://www.drupal.org/SA-CORE-2016-001...
Session data truncation can lead to unserialization of user provided data
More info at https://www.drupal.org/SA-CORE-2016-001...