Access Restriction Bypass

drupal is vulnerable to access restriction bypass. The bypass is possible because it uses the default fallback for access queries while using node access controls with a multilingual site, leading to the bypass of access restriction...

Unauthorized Access

drupal/drupal is vulnerable to unauthorized access attacks. The vulnerability exists in the Comment reply form where users who can post comments are able to view and add comments that they are not authorized to do so...

Drupal Permissions by Term Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.The Permissions by Term module is a module from Drupal. The module provides both front-end and back-end functionality. No programming skills are required, and the module can be handled ...

Drupal Automated Logout Module HTML Injection Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An HTML injection vulnerability exists in Drupal's Automated Logout module that stems from a failure to adequately validate user input. An attacker could exploit this...

Drupal Mosaik Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Mosaik module that stems from a failure to adequately validate user text input. An attacker could use the...

TB Nucleus - Critical - Unsupported - SA-CONTRIB-2018-031

Update - 2018-09-26 This maintainer has fixed this security issue. Please install https://www.drupal.org/project/nucleus/releases/7.x-1.6 to fix the security issue The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the...

SimpleCrop - Critical - Unsupported - SA-CONTRIB-2018-030

Update: 2018-06-01 A new maintainer has stepped forward to maintain this module and has put out a new release. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module...

Drupal < 7.58 / 8.x < 8.3.9 / 8.4.x < 8.4.6 / 8.5.x < 8.5.1 Remote Code Execution

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. Note: This has been detected using an active check and...

A week in security (May 14 – May 20)

Last week, we looked at the deluge of incoming policies caused by GDPR, tackled Adobe Reader zero days, and ran through some iPhone security tips. We also caught some helpline scammers in the act, explored advergaming, got our Senate Bill game face on, and deep dived into Drupal vulnerabilities...

Drupal Skype Status Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability in the Drupal Skype Status module exists because the program fails to adequately validate user input. An attacker could use the...

Drupal Yandex.Metrics module cross-site scripting vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Yandex.Metrics module that stems from a failure to adequately validate user input. The vulnerability can be...

Drupal netFORUM Authentication Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. netFORUM Authentication is one of the modules that implements external authentication for users . An access bypass vulnerability exists in the Drupal netFORUM Authentication module. An...

Drupal Avatar Uploader File Disclosure

File disclosure vulnerability in Drupal Avatar Uploader module Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

A look into Drupalgeddon’s client-side attacks

Drupal is one of the most popular Content Management Systems CMS, along with WordPress and Joomla. In late March 2018, Drupal was affected by a major remote code execution vulnerability CVE-2018-7600 followed by yet another CVE-2018-7602 almost a month later, both aptly nicknamed Drupalgeddon 2 a...

Open Redirect

Drupal is vulnerable to open redirects. A malicious user can inject a malicious link to the application through the language switcher, which can then be used to cause open redirects...

Drupal Clientside Validation Module Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal Clientside Validation module. An attacker can exploit the vulnerability to execute arbitrary PHP code in the...

Drupal CKEditor Enhanced Image plugin cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.CKEditor is one of the text editors.Enhanced Image aka image2 is one of the image enhancement plugins. A cross-site scripting vulnerability exists in the Enhanced Image plugin in Drupal...

Drupal H5P Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A cross-site scripting attack vulnerability exists in the Drupal H5P module,...

Cross-site Scripting (XSS)

drupal/drupal is vulnerable to cross-site scripting XSS attacks. The checkPlain function doesn't properly sanitize escape characters, allowing a malicious user to inject and execute arbitrary Javascript...

Drupal Alinks Module Authentication Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An authentication bypass vulnerability exists in the Drupal Alinks module. An attacker can exploit the vulnerability to bypass security restrictions and perform unauthoriz...