New Relic: XSS in a newrelic.com site

Hello, I found a XSS vulnerability that could be used by an attacker to execute javascript in the client, for example, an attacker could steal the cookie of the user or an attacker could redirect the client to an attacker site and try to exploit vulnerabilities against the browser. Here you can...

Drupal Google Analytics Counter Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Google Analytics Counter is one of the website traffic analysis modules. A cross-site request forgery vulnerability exists in Drupal Google Analytics Counter versions prior to 7.x-3.2,...

Drupal Hubspot CTA module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Hubspot CTA is one of the modules that displays the Hubspot CTA button by creating a Bean block. A cross-site scripting vulnerability exists in the Drupal Hubspot CTA module that can be...

Drupal FileField Module Remote Denial of Service Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.FileField is one of the file upload components that uses the CCK feature extension. A remote denial of service vulnerability exists in versions 6.x-3.x of the Drupal FileField module...

Drupal USASearch Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.USASearch is one of the theme search modules. An access bypass vulnerability exists in Drupal USASearch module versions prior to 7.x-5.1, which can be exploited by an attacker to bypass...

Multiple vulnerabilities in Drupal Node Notify module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Notify is one of the node modules that allows registered users and anonymous users to subscribe. A cross-site scripting vulnerability and a cross-site request forgery vulnerability...

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

More info at https://www.drupal.org/SA-CORE-2016-003...

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

More info at https://www.drupal.org/SA-CORE-2016-003...

Drupal 7.x < 7.44 / 8.1.x < 8.1.3 User Module Account Saving Improper Role Assignment Remote Issue

Binary data 9399.prm...

Drupal Releases Security Advisory

Drupal has released an advisory to address a vulnerability in Drupal core 8.x versions prior to 8.1.7. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Drupal's Security Advisory and apply the...

Drupal RESTWS Module Page Callback RCE

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the bundled RESTful Web services RESTWS module due to a flaw in how default page callbacks for Drupal entities are altered when handling specially crafted requests. An unauthenticated,...

Drupal Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Drupal has security bypass vulnerabilities that could be exploited by remote attackers to bypass security restrictions...

Drupal Privilege Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Drupal has an elevation of privilege vulnerability that allows remote attackers to exploit the vulnerability to elevate privileges...

Drupal Coder RCE

Remote Code Execution in Drupal Coder module Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Drupal RESTful Web Services RCE

Remote Code Execution in Drupal RESTful Web Services module Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Drupal WikiWiki SQL Injection

SQL Injection vulnerability in Drupal WikiWiki module find parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

3 Popular Drupal Modules Found Vulnerable — Patch Released

Just yesterday, I wrote a warning article announcing that Drupal – the popular open source content management system – will release patches for several highly critical Remote Code Execution RCE bugs that could allow attackers to fully take over any affected site. Below are the three separate Drup...

Drupal Patches Three Remote Code Execution Vulnerabilities in Modules

Developers with the open source content management framework Drupal today patched a series of highly critical remote code execution bugs in three separate modules. If exploited, the bugs could let an attacker take over any site running the modules. Fixes for pushed for RESTful Web Services, a...

Several Critical Remotely Exploitable Flaws Found in Drupal Modules, patch ASAP!

The extraordinary 'Panama Papers leak' from Law firm Mossack Fonseca that exposed the tax-avoiding efforts by the world's richest and most influential members was initially believed to be the result of an unpatched vulnerability in the popular content management systems: Drupal and WordPress. Now...

Drupal Webform Multiple File Upload Remote Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community; Webform Multiple File Upload module is a file upload module for Drupal. A remote code execution vulnerability exists in the Drupal Webform Multiple File Upload module. The vulnerabilit...