14278 matches found
Drupal Views access bypass vulnerability (CNVD-2017-221665)
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views is one of the view components. An access bypass vulnerability exists in Drupal Views versions prior to 7.x-3.17. An attacker can exploit this vulnerability to bypass security...
CoMisSion: Open Source WhiteBox CMS Analysis Tool
PenTestIT RSS Feed Less than a week ago, an open source white-box CMS analysis tool was released - CoMisSion. I had covered a similar local web application vulnerability scanner - pyfiscan. This new tool tends to automate a lot of tasks that help you analyze a CMS setup and tend to be long, tedio...
Drupal Views Refresh Security Bypass Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views Refresh is one of the page view refresh modules. A security bypass vulnerability exists in Drupal Views Refresh versions prior to 7.x-1.2. A remote attacker can exploit this...
FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)
Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...
Drupal Patches Critical Access Bypass Bug
Website management platform Drupal released several patches that address access bypass vulnerabilities in its Drupal 8 Core engine Wednesday, fixing one critical and two moderately critical security bugs. The most serious of the vulnerabilities is the access bypass vulnerability CVE-2017-6925 in...
Drupal Entity Access Bypass Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in version 8.x of Drupal Entity prior to 8.3.7. An attacker can exploit this vulnerability to bypass security restrictions and perfor...
Drupal REST API Security Bypass Vulnerability
Drupal core is a free, open source content management system developed in PHP and maintained by the Drupal community. A security bypass vulnerability exists in version 8.x of the Drupal REST API prior to 8.3.7. An attacker can exploit this vulnerability to bypass security restrictions and perform...
Drupal Views Access Bypass Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Views is one of the view components. An access bypass vulnerability exists in version 8.x of Drupal Views prior to 8.3.7. An attacker could use this vulnerability to bypass security...
Drupal Core Multiple Vulnerabilities (SA-CORE-2017-004) - Windows
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Drupal Core Multiple Vulnerabilities (SA-CORE-2017-004) - Linux
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...
Entity access bypass for entities that do not have UUIDs or have protected revisions.
More info at https://www.drupal.org/SA-CORE-2017-004...
REST API can bypass comment approval.
More info at https://www.drupal.org/SA-CORE-2017-004...
Entity access bypass for entities that do not have UUIDs or have protected revisions.
More info at https://www.drupal.org/SA-CORE-2017-004...
REST API can bypass comment approval.
More info at https://www.drupal.org/SA-CORE-2017-004...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...
Views refresh - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-069
When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views refresh module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to...
Drupal Releases Security Updates
Drupal has released an advisory to address several vulnerabilities in Drupal 8.x. A remote attacker could exploit one of these vulnerabilities to obtain or modify sensitive information. US-CERT encourages users and administrators to review Drupal's Security Advisory and upgrade to version 8.3.7...
Entity Reference - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-067
The entity reference module provides a field type that can reference arbitrary entities. In a vulnerable configuration, an attacker could determine the titles of nodes they do not have access to. This is mitigated as only entity reference fields using the "simple" entity selector are vulnerable,...
drupal -- Drupal Core - Multiple Vulnerabilities
Drupal Security Team: CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...