Drupal 8.x, 9.x Multiple Vulnerabilities (SA-CORE-2020-005, SA-CORE-2020-006) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal 7.x, 8.x jQuery XSS Vulnerabilities (SA-CORE-2020-002) - Windows

Drupal is prone to multiple cross-site scripting vulnerabilities in jQuery. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Drupal 7.x, 8.x jQuery XSS Vulnerabilities (SA-CORE-2020-002) - Linux

Drupal is prone to multiple cross-site scripting vulnerabilities in jQuery. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Vulnerability fixed in Drupal

Drupal has fixed a vulnerability in the Form API of the Drupal Core. The vulnerability allows a remote malicious party to able to perform a Cross-Site Request Forgery attack XSRF. A successful attack could thereby lead to consequential damage such as the obtaining sensitive data from a domain to...

Drupal Releases Security Updates

Drupal has released security updates to address vulnerabilities affecting Drupal 7, 8.8, 8.9, and 9.0. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators ...

Drupal 7.0.x < 7.72 / 8.8.x < 8.8.8 / 8.9.x < 8.9.1 / 9.0.x < 9.0.1 Multiple Vulnerabilities (drupal-2020-06-17)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, or 9.0.x prior to 9.0.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but h...

DLA-2250-1 drupal7 - security update

Bulletin has no description...

DRUPAL-CORE-2020-006

JSON:API PATCH requests may bypass validation for certain fields. By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the readonly set to FALSE under jsonapi.settings config are vulnerable...

DRUPAL-CORE-2020-005

Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to...

DRUPAL-CORE-2020-004

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005

Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to...

PT-2020-4195 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 8.8.8 Drupal Core versions prior to 8.9.1 Drupal Core version 9.0.1 Description: The issue is related to an arbitrary PHP code execution vulnerability under certain circumstances. An attacker could trick an...

PT-2020-6778

Name of the Vulnerable Software and Affected Versions Drupal Core affected versions not specified Description The issue is related to insufficient authentication of executed requests in the Drupal CMS system. It can be exploited by a remote attacker to execute arbitrary code. Additionally, there ...

Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...

Internationalization - Moderately critical - Cross site scripting - SA-CONTRIB-2020-025

The Internationalization i18n module is a collection of modules to extend Drupal core multilingual capabilities and allows to build real life multilingual sites. A value in the term translation module is displayed without being escaped leading to a Cross Site Scripting XSS vulnerability. This...

Drupal core - Less critical - Access bypass - SA-CORE-2020-006

JSON:API PATCH requests may bypass validation for certain fields. By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the readonly set to FALSE under jsonapi.settings config are vulnerable...

drupal -- Multiple Vulnerabilities

Drupal Security Team reports: The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...

[SECURITY] Fedora 32 Update: drupal8-8.9.0-1.fc32

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

IBM API Connect Open Redirect Vulnerability

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in the 'drupalgoto' function in IBM API Connect versions 5.0.0.0...

Security Bulletin: IBM API Connect V5 is impacted by an Open Redirect vulnerability in Drupal core(CVE-2020-13662)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13662 DESCRIPTION: Drupal Core could allow a remote attacker to conduct phishing attacks, caused by insufficient validation of the destination query parameter in the drupalgoto function. By...