PT-2020-8021

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal version 7.x-1.x Description: The issue allows comment access bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For version 7.x-1.x, update to a version that includes the fi...

PT-2020-8471

Name of the Vulnerable Software and Affected Versions: AES encryption project versions 7.x through 8.x Description: The AES encryption project for Drupal does not sufficiently prevent attackers from decrypting data. This issue is not covered by Drupal's security advisory policy. Recommendations:...

PT-2020-8020

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal versions 7.x-1.x Description: The issue allows node access bypass. This project is not covered by Drupal's security advisory policy. Recommendations: For versions 7.x-1.x, update to a version that includes the fix...

PT-2020-8026

Name of the Vulnerable Software and Affected Versions: REST/JSON project for Drupal version 7.x-1.x Description: The issue allows session name guessing. This project is not covered by Drupal's security advisory policy. Recommendations: For version 7.x-1.x, update to a version that includes a fix...

CVE-2016-20001: Incorrect Authorization

The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20006: Undefined Security Weakness

The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2016-20008: Undefined Security Weakness

The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...

U.S. Dept Of Defense: [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████

Summary Due to an outdated Drupal version, remote code execution is possible on www.█████ via CVE-2018-7600. Description Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple...

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

Default credentials

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35191

The provided sources identify CVE-2020-35191 as affecting official Drupal Docker images prior to 8.5.10-fpm-alpine (Alpine). The vulnerability is a blank root password, enabling a remote attacker to gain root access in affected containers. Exploit details, affected version ranges, and concrete fi...

PT-2020-17281

Name of the Vulnerable Software and Affected Versions drupal versions prior to 8.5.10-fpm-alpine Description The official drupal docker images contain a blank password for a root user. Systems using the drupal docker container deployed by affected versions of the docker image may allow a remote...

CVE-2020-35191: Missing Authentication for Critical Function

The official drupal docker images before 8.5.10-fpm-alpine Alpine specific contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

Docker Images Official Drupal Access Control Error Vulnerability

Docker is an open source application container engine from the American company Docker. It supports the creation of a container lightweight virtual machine and the deployment and running of applications on Linux systems, as well as the automated installation, deployment and upgrading of...

[SECURITY] Fedora 32 Update: drupal8-8.9.11-1.fc32

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 33 Update: drupal8-8.9.11-1.fc33

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Fedora 33 : drupal8 (2020-6f1079934c)

https://www.drupal.org/project/drupal/releases/8.9.11 - https://www.drupal.org/project/drupal/releases/8.9.10 - https://www.drupal.org/sa-core-2020-013 CVE-2020-28948 / CVE-2020-28949 - https://www.drupal.org/project/drupal/releases/8.9.9 - https://www.drupal.org/sa-core-2020-012 CVE-2020-13671 -...

Security Bulletin: IBM API Connect is vulnerable to arbitrary code execution and security bypass in Drupal (CVE-2020-13664, CVE-2020-13665)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-13664 DESCRIPTION: Drupal core could allow a remote attacker to execute arbitrary code on the system, caused by code injection flaw. By persuading a victim to visit a specially-crafted web...