VulnCheck KEV: CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

Security Bulletin: IBM API Connect is impacted by a directory traversal vulnerability in Drupal core SA-CORE-2021-001 (CVE-2020-36193)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-36193 DESCRIPTION: ArchiveTar could allow a remote attacker to traverse directories on the system, caused by inadequate checking of symbolic links. An attacker could send a specially-crafted U...

DRUPAL-CONTRIB-2021-005

The Fast Autocomplete module provides fast IMDB-like suggestions below a text input field. Suggestions are stored as JSON files in the public files folder so that they can be provided to the browser relatively fast without the need for Drupal to be bootstrapped. The module doesn't correctly...

USN-4773-1 drupal7 vulnerabilities

It was discovered that Drupal did not properly process certain input. An attacker could use this vulnerability to execute arbitrary code or completely compromise a Drupal site. CVE-2018-7600, CVE-2018-7602 It was discovered that password reset URLs in Drupal could be forged. An attacker could use...

USN-4773-1: Drupal vulnerabilities

It was discovered that Drupal did not properly process certain input. An attacker could use this vulnerability to execute arbitrary code or completely compromise a Drupal site. CVE-2018-7600, CVE-2018-7602 It was discovered that password reset URLs in Drupal could be forged. An attacker could use...

DRUPAL-CONTRIB-2021-004

The Webform module for Drupal 8/9 includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form. The confirmation email can be used as an open mail relay to send an email to any email address. This...

PT-2021-31111

The Webform module for Drupal 8/9 includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form. The confirmation email can be used as an open mail relay to send an email to any email address. This...

Webform - Moderately critical - Access bypass - SA-CONTRIB-2021-004

The Webform module for Drupal 8/9 includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form. The confirmation email can be used as an open mail relay to send an email to any email address. This...

EulerOS 2.0 SP2 : pki-core (EulerOS-SA-2021-1346)

According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Dogtag PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. PKI consists of the following...

Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2021-1346)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CMSmap

It is an offensive tool for web application security testing. The primary CVE ID is not present in the provided context. The target product/service or framework is not explicitly stated, but the tool appears to be designed for testing popular Content Management Systems CMSs such as WordPress,...

Drupal Kernel Code Execution

The vulnerability of the Drupal CMS system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and take control of the website through a specially crafted HTTP request...

Security Bulletin: IBM API Connect's Developer Portal is vulnerable to arbitrary code excution in Drupal Core (CVE-2020-13671)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13671 DESCRIPTION: Drupal Core could allow a remote attacker to execute arbitrary code on the system, caused by the failure to properly sanitize certain filenames on uploaded files. By...

Security Bulletin: IBM API Connect's Developer Portal is impacted by multiple vulnerabilities in Drupal core.

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13669 DESCRIPTION: Drupal core is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the built-in CKEditor image caption functionality. A remote...

DRUPAL-CONTRIB-2021-002

The Social User Export module enables users within Open Social to create an export of users and download this to a CSV file. The module doesn't sufficiently check access when building the CSV file, allowing logged-in users without the manage members permission to be able to export all data from a...

Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Linux

Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal 7.x, 8.x, 9.x Archive_Tar library Vulnerability (SA-CORE-2021-001) - Windows

Drupal is prone to a vulnerability in the ArchiveTar library. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drupal 9.1.x < 9.1.3 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 9.0.x < 9.0.11 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 8.9.x < 8.9.13 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...