The vulnerability of the Drupal CMS system, related to improper code generation, allows attackers to execute arbitrary code.

The vulnerability of the Drupal CMS system is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

DRUPAL-CONTRIB-2022-051

This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance. The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit...

DRUPAL-CONTRIB-2022-050

This module enables you to generate PDF versions of content. Some installations of the module make use of the dompdf/dompdf third-party dependency. Security vulnerabilities exist for versions of dompdf/dompdf before 2.0.0 as described in the 2.0.0 release notes...

Drupal RCE Vulnerability (SA-CORE-2022-014) - Linux

Drupal is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal RCE Vulnerability (SA-CORE-2022-014) - Windows

Drupal is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal 代码问题漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A code issue vulnerability exists in Drupal versions prior to 9.3.19 and prior to 9.4.3, which stems from filenames not being cleaned up properly. An attacker could exploit this vulnerability to remotely...

Drupal 访问控制错误漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. An Access Control Error vulnerability exists in Drupal versions prior to 9.3.19 and prior to 9.4.3 that stems from improperly restricted access. A remote attacker could use this vulnerability to alter dat...

Drupal 9.3.x < 9.3.19 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19 or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities: - In some situations, the Image module does not correctly check access to...

Drupal 9.4.x < 9.4.3 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19 or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities: - In some situations, the Image module does not correctly check access to...

Drupal Releases Security Update 

Drupal has released security updates to address vulnerabilities affecting Drupal 9.3 and 9.4. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Drupal security advisory SA-CORE-2022-015 and apply the...

Drupal 7.x < 7.91 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19 or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities: - In some situations, the Image module does not correctly check access to...

Drupal 跨站脚本漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A cross-site scripting vulnerability exists in Drupal versions prior to 9.3.19 and prior to 9.4.3, which stems from Media oEmbed iframe routing that does not properly validate iframe domain settings...

Drupal 安全漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal versions prior to 7.91, prior to 9.3.19, and prior to 9.4.3, which stems from the image module not properly checking for image files that are not stored in the...

Drupal 7.x < 7.91 / 9.3.x < 9.3.19 / 9.4.x < 9.4.3 Multiple Vulnerabilities (drupal-2022-07-20)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19, or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities. - The Media oEmbed iframe route does not properly validate the iframe domai...

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012

More info at https://www.drupal.org/sa-core-2022-012...

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014

More info at https://www.drupal.org/sa-core-2022-014...

DRUPAL-CORE-2022-015

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. This advisory is not covere...

DRUPAL-CORE-2022-014

Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference:...

DRUPAL-CORE-2022-013

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...

DRUPAL-CORE-2022-012

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...