Drupal Security Bypass Vulnerability (CNVD-2017-13903)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in version 8.x of Drupal prior to 8.3.4. An attacker can exploit this vulnerability to bypass security restrictions and perform...

Drupal File Upload Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Drupal versions 7.x prior to 7.56 and 8.x prior to 8.3.4. An attacker can exploit this vulnerability to bypass security restrictions and...

Drupal Core Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in Drupal versions 7.x prior to 7.56 and 8.x prior to 8.3.4. A remote attacker could exploit this vulnerability to execute...

Drupal Patches Three Vulnerabilities in Core

Developers with Drupal patched three vulnerabilities, one critical, one being exploited in the wild, in Drupal’s core engine on Wednesday. Drupal 7.56 and 8.3.4 are security releases. Update your sites. — Drupal Security @drupalsecurity June 21, 2017 The most pressing issue addressed by the updat...

Drupal Core Multiple Vulnerabilities (SA-CORE-2017-003) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Core Multiple Vulnerabilities (SA-CORE-2017-003) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

PECL YAML parser unsafe object handling

More info at https://www.drupal.org/SA-CORE-2017-003...

PECL YAML parser unsafe object handling

More info at https://www.drupal.org/SA-CORE-2017-003...

File REST resource does not properly validate

More info at https://www.drupal.org/SA-CORE-2017-003...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team Reports: CVE-2017-6920: PECL YAML parser unsafe object handling. CVE-2017-6921: File REST resource does not properly validate CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users...

VulnCheck KEV: CVE-2017-6922

In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not...

Drupal Releases Security Updates

Drupal has released an advisory to address several vulnerabilities in Drupal versions 7.x and 8.x. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Drupal's Security Advisory and upgrade to...

Search 404 - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-053

The Search 404 module enables you to redirect 404 pages to a search page on the site for the keywords in the url that was not found. The module did not filter administrator-provided text before displaying it to the user on the 404 page creating a Cross Site Scripting XSS vulnerability. This...

Drupal Public Download Count Module Open Redirect Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An open redirect vulnerability exists in the Drupal Public Download Count module. Allow attackers to exploit the vulnerability to allow users to access malicious websites,...

LDAP - Critical - Data Injection - SA-CONTRIB-2017-052

The LDAP module does not sanitize user input correctly in several cases, allowing a user to modify parameters without restriction and inject data. If the site administrator chooses to hide the email or password from the user form instead of showing or disabling it under "Authorization", these...

Access Bypass

drupal core is vulenrable to access bypass. If a website is running RESTful Web Services and allows PATCH requests, an authenticated user can bypass access restrictions...

Drupal Shibboleth authentication module access bypass vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Shibboleth Authentication is one of the user login and get access to the authentication module . An access bypass vulnerability exists in the Drupal Shibboleth authentication module...

Drupal Bootstrap Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in the Drupal Bootstrap module. An attacker can exploit this vulnerability to obtain sensitive information leading to furthe...

Custom Landing Page Builder - Unsupported - SA-CONTRIB-2017-050

The Custom Landing Page Builder module allows webmasters to build custom landing pages using a WYSIWYG editor while still having full control over the full layout of the page including the header, navigation, page content, footer, forms etc. The security team is marking this module unsupported...

Drupal Linkit Module Access Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. An access bypass vulnerability exists in the Drupal Linkit module. An attacker can exploit this vulnerability to perform unauthorized operations bypassing some security restrictions...