CVE-2014-1398: Improper Access Control

The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors...

Drupal avatar_uploader arbitrary file download vulnerability

avataruploader is the module used to implement the function of uploading user images in a content management system maintained by the Drupal community. A security vulnerability exists in avataruploader version 7.x-1.0-beta8, which is caused by code in the view.php file that fails to validate user...

Remote Code Execution (RCE)

drupal/core is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of sanitization applied to URL endpoints where array objects can be supplied to request parameters, allowing a potential compromise of the PHP application, and even the underlying operating...

Drupal 8 – CVE-2017-6926漏洞详解

作者：绿盟科技 来源： 近期，著名的Drupal CMS网站爆出7个漏洞，其中1个严重漏洞CVE-2017-6926，具有发表评论权限的用户可以查看他们无权访问的内容和评论，并且还可以为该内容添加评论。绿盟科技于上周发布了《Drupal下周将发布重要安全补丁威胁预警通告》。 本篇文章对Drupal 8 – CVE-2017-6926漏洞进行了详细分析。 CVE-2017-6926 漏洞详情 先看下drupal官网的通告： 有发布评论权限的用户，可以查看他们无权访问的内容和评论。 并且还可以为此内容添加评论。 想要触发这个漏洞，必须启用评论系统，并且攻击者必须有权发布评论。...

BadMod - Detect Website CMS, Website Scanner & Auto Exploiter

Auto exploiter & get all server sites & bing dorker Installation git clone https://github.com/MrSqar-Ye/BadMod.git BadMod tool Detect website cms & website scanner =& Auto exploiter Exploit : ! Wordpress +joomla !drupal + Cms made simple Video Download BadMod...

[ASA-201804-1] drupal: arbitrary code execution

Arch Linux Security Advisory ASA-201804-1 ========================================= Severity: Critical Date : 2018-04-01 CVE-ID : CVE-2018-7600 Package : drupal Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-665 Summary ======= The package drupal before...

Exploit for Improper Input Validation in Drupal

IMPORTANT: Is provided only for educational or information p...

Exploit for Improper Input Validation in Drupal

CVE-2018-7600 Drupal RCE Credits to: File | Drupal Ver | Sou...

Drupal Directory Listing

The scanner has detected publicly accessible Drupal directory index on the target web application. This may expose information relating to the web server to an attacker which may allow for further exploitation techniques to be leveraged, possibly leading to a compromise of the target server No...

Drupal core Remote Code Execution(CVE-2018-7600) (Drupalgeddon2)

Two weeks ago, a highly critical 21/25 NIST rank vulnerability, nicknamed Drupalgeddon 2 SA-CORE-2018-002 / CVE-2018-7600, was disclosed by the Drupal security team. This vulnerability allowed an unauthenticated attacker to perform remote code execution on default or common Drupal installations...

Code injection

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

CVE-2014-5170

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

CVE-2014-5170

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

CVE-2014-5170

The CVE-2014-5170 entry concerns the Drupal Storage API module. Affected: Storage API module for Drupal 7.x before 7.x-1.6. Root cause: failure to update .htaccess file contents after SA-CORE-2013-003, enabling remote attackers to execute arbitrary code. The issue is documented in DRUPAL-SA-CONTR...

CVE-2014-5170

The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003...

Drupal Issues Highly Critical Patch: Over 1M Sites Vulnerable

Drupal released a patch for a “highly critical” flaw in versions 6, 7 and 8 of its CMS platform that could allow an attacker to take control of an affected site simply by visiting it. Drupal also warned an unprivileged and untrusted attacker could modify or delete data hosted on affected CMS...

CVE-2018-7600

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations...

CVE-2018-7600

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations...

UBUNTU-CVE-2018-7600

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations...

Code injection

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations...