14278 matches found
[SECURITY] Fedora 24 Update: drupal8-8.2.7-1.fc24
Drupal is an open source content management platform powering millions of websites and applications. Its built, used, and supported by an active and diverse community of people around the world...
Drupal Office Hours Module Cross-Site Scripting Vulnerability
Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Office Hours is one of the modules that defines the "Weekly Office Hours" field type. A cross-site scripting vulnerability exists in the Drupal Office Hours module, which is caused by a...
Drupal Private Module Access Bypass Vulnerability
Drupal is an open source content management framework CMF written in PHP, which consists of a content management system CMS and a PHP development framework Framework. An access bypass vulnerability exists in Drupal Private Module. An attacker can exploit this vulnerability to perform unauthorized...
droopescan - A plugin-based scanner that aids security researchers in identifying issues with several CMSs (Drupal, Silverstripe & Wordpress)
A plugin-based scanner that aids security researchers in identifying issues with several CMS: Drupal. SilverStripe. Wordpress. Partial functionality for: Joomla version enumeration and interesting URLs only. Moodle identification doesn't work yet. You need to force 'scan moodle'...
Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001)
The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities : - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configur...
Linkit - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-033
Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field. When searching for entities, this module doesn't always enforce the access restrictions and users may see information about entities they should not be able to access. This is...
Office Hours - Moderately Critical - Cross Site Scripting - DRUPAL-SA-CONTRIB-2017-032
This module enables you to show the office hours of a location to the public. The module doesn't sufficiently filter user input for malicious Cross Site Scripting xss. This vulnerability is mitigated by the fact that an attacker must have a role with a permission to add fields to an entity. CVE...
Drupal Arbitrary Code Execution Vulnerability (CNVD-2017-03745)
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in versions of Drupal prior to 8.2.2. A remote attacker can exploit this vulnerability to execute code...
Drupal cross-site request forgery vulnerability (CNVD-2017-03746)
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site request forgery vulnerability exists in Drupal versions 8.2.x prior to 8.2.7, which stems from the program's failure to protect the administrative path with a...
Drupal Multiple Vulnerabilities (SA-2017-001) - Linux
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Drupal Multiple Vulnerabilities (SA-2017-001) - Windows
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
CVE-2017-6379
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID...
CVE-2017-6377
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass...
CVE-2017-6379
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID...
Cross site request forgery (csrf)
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID...
CVE-2017-6379
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID...
Remote code execution
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...
CVE-2017-6381
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...
CVE-2017-6381
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...