Security feature bypass

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

CVE-2017-6925

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

CVE-2017-6925

Drupal 8 core before 8.3.7 contains an entity access system vulnerability (CVE-2017-6925) that could allow a remote attacker to view, create, update, or delete entities for which UUIDs are missing or where revision-based access differs. Affected versions are Drupal 8 core prior to 8.3.7; the issu...

CVE-2017-6925

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

CVE-2017-6925

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

PT-2019-8595

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.3.7 Description The issue affects sites with the RESTful Web Services rest module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to pos...

PT-2019-8596

Name of the Vulnerable Software and Affected Versions Drupal 8 core versions prior to 8.3.7 Description There is an issue in the entity access system that could allow unwanted access to view, create, update, or delete entities. This issue affects entities that do not use or do not have UUIDs, and...

CVE-2017-6925: Undefined Security Weakness

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

PT-2019-8592

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.3.4 Description The issue arises from improper validation of certain fields when manipulating files through the file REST resource. This affects sites with the RESTful Web Services rest module enabled, where the fi...

CVE-2017-6921: Improper Input Validation

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...

CVE-2018-7603: Improper Neutralization of Input During Web Page Generation

In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website nodes, comments, etc.. The module doesn't sufficiently filter user-entered...

CVE-2017-6924: Improper Privilege Management

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services rest module enabled, the...

Imperva Increases Self-Service Capability Fourfold with Custom Security Rules

Back in 2014, we introduced Rules previously IncapRules to give our customers advanced control over their application security. Today we’re putting even more of this custom tuning power in the hands of our customers by quadrupling the number of filters available via self-service. Rules Basics Rul...

The State of Web Application Vulnerabilities in 2018

Jan. 12 update: Due to a data transfer error, some of the 2017 figures were incorrectly reported; this version of the blog has been corrected. This error did not affect our 2018 statistics, nor our conclusions. As a web application firewall provider, part of our job at Imperva is to continually...

Aegir HTTPS - Moderately critical - Access bypass - SA-CONTRIB-2019-003

Aegir is a Web hosting control panel program that provides a Drupal-based graphical interface designed to simplify deploying, managing and upgrading an entire network of Drupal, Wordpress and CiviCRM Web sites. The Hosting HTTPS module is a commonly used piece of the Aegir platform. This module...

Phone Field - Critical - SQL Injection - SA-CONTRIB-2019-001

This module provides a phone field for Drupal 7 that supports the HTML5 tel:-schema. In an API function that is not used by the module, the name for the phone field is not sufficiently sanitised when using it in database queries. This vulnerability is mitigated by the fact that it affects an unus...

Security Bulletin: IBM API Connect Developer Portal is affected by Insecure Session Management in Drupal

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: Not Applicable DESCRIPTION: Session Limit module for Drupal could allow a remote attacker to obtain sensitive information, caused by improper tokenize of the list of sessions. By inspecting the forms, ...

drupal.360dynamics.com.sg XSS vulnerability

Open Bug Bounty ID: OBB-714761 Description| Value ---|--- Affected Website:| drupal.360dynamics.com.sg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

Drupal 7 CivicRM 5.8.2 Database Disclosure

Exploit Title : Drupal 7 CivicRM Modules 5.8.2 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 24/12/2018 Vendor Homepage : drupal.org - civicrm.org Software Download Link : download.civicrm.org/civicrm-5.8.2-drupal.tar.gz +...

DRUPAL-CONTRIB-2018-081

This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when responding to certain filtered collection requests, thereby causing an access bypass vulnerability. This mea...