CVE-2016-20005: Incorrect Authorization

The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20006: Undefined Security Weakness

The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20008: Undefined Security Weakness

The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

PT-2020-8913

Name of the Vulnerable Software and Affected Versions KCFinder integration project for Drupal versions prior to 2018-06-01 Description The issue concerns the mishandling of validation in the uploader.php file. This could potentially lead to security issues, although specific details about...

PT-2020-8023

Name of the Vulnerable Software and Affected Versions: REST/JSON project versions 7.x-1.x for Drupal Description: The issue allows field access bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For versions 7.x-1.x, consider restricting access to sensitive...

PT-2020-8024

Name of the Vulnerable Software and Affected Versions: REST/JSON project versions 7.x-1.x for Drupal Description: The issue allows user registration bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For versions 7.x-1.x, consider disabling user registratio...

PT-2020-8021

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal version 7.x-1.x Description: The issue allows comment access bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For version 7.x-1.x, update to a version that includes the fi...

PT-2020-8471

Name of the Vulnerable Software and Affected Versions: AES encryption project versions 7.x through 8.x Description: The AES encryption project for Drupal does not sufficiently prevent attackers from decrypting data. This issue is not covered by Drupal's security advisory policy. Recommendations:...

PT-2020-8020

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal versions 7.x-1.x Description: The issue allows node access bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For versions 7.x-1.x, update to a version that includes the fix...

PT-2020-8026

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal version 7.x-1.x Description: The issue allows session name guessing. This project is not covered by Drupal's security advisory policy. Recommendations: For version 7.x-1.x, update to a version that includes a fix...

CVE-2016-20001: Incorrect Authorization

The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20007: Insufficient Session Expiration

The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

U.S. Dept Of Defense: [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████

Summary Due to an outdated Drupal version, remote code execution is possible on www.█████ via CVE-2018-7600. Description Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple...

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

Default credentials

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35191

The provided sources identify CVE-2020-35191 as affecting official Drupal Docker images prior to 8.5.10-fpm-alpine (Alpine). The vulnerability is a blank root password, enabling a remote attacker to gain root access in affected containers. Exploit details, affected version ranges, and concrete fi...

PT-2020-17281

Name of the Vulnerable Software and Affected Versions drupal versions prior to 8.5.10-fpm-alpine Description The official drupal docker images contain a blank password for a root user. Systems using the drupal docker container deployed by affected versions of the docker image may allow a remote...

CVE-2020-35191: Missing Authentication for Critical Function

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...