Multiple vulnerabilities in Drupal HybridAuth Social Login module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. An information disclosure and open redirection vulnerabili...

Drupal Login one time 'Ajax Callback' module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. login one time is one of the modules used to send one-time login link emails to users. A cross-site scripting vulnerability exists in the Drupal Login one time module in versions 7.x-2...

Drupal Boost Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Boost is one of the modules that improves the performance of a website by optimizing page caching of static files for anonymous users. An information disclosure vulnerability exists in...

Drupal Commerce Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. commerce is one of the e-commerce modules. An information disclosure vulnerability exists in version 7.x-1.x of the Drupal Commerce module before 7.x-1.13. An attacker can exploit this...

Drupal Fast Autocomplete Module Remote Denial of Service Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Fast Autocomplete is one of the modules used to quickly create configurable view patterns. A remote denial of service vulnerability exists in version 7.x-1.x of the Drupal Fast...

Drupal Scald File Module Remote Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Scald File is one of the modules used to handle multimedia. A remote code execution vulnerability exists in the Drupal Scald File module, version 7.x-1.x prior to 7.x-1.2. An attacker...

Drupal Node Embed Module Remote Denial of Service Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Embed is one of the node modules used to integrate CKEditor's input filters into the content editor and embed them within the body of the article. A remote denial of service...

Drupal XML Sitemap Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. XML Sitemap is one of the modules that makes it easy for search engines to intelligently index Drupal. A cross-site scripting vulnerability exists in Drupal XML Sitemap versions 7.x-2....

Drupal 8.x < 8.1.7 PHP HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)

The version of Drupal running on the remote web server is 8.x prior to 8.1.7. It is, therefore, affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTPPROXY environment variable ...

Drupal Page Manager Search Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Page Manager Search is one of the modules that provides page search capabilities through the Drupal core search module. An information disclosure vulnerability exists in versions 7.x-1....

Multiple vulnerabilities in Drupal REST JSON module

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.REST JSON is one of the interface modules used to expose Drupal content. The Drupal REST JSON module version 7.x-1.x has a 1. security bypass vulnerability 2. user enumeration...

Drupal RESTWS Module Remote PHP Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal RESTWS Module Remote PHP Code Execution', 'Description' = %q This module exploits a Remote PHP Code Execution vulnerability in Drupal RESTW...

drupal: proxy injection

Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP requests. An attacker can provide a proxy server that Guzzle will use. This vulnerability is called 'httpoxy'. httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It...

Drupal Opening Hours Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. opening hours is one of the modules used to find stores or libraries that are open at a certain time. A cross-site scripting vulnerability exists in the Drupal Opening Hours module in...

Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution', 'Description' = %q This module exploits the Drupal RESTWS module...

Drupal Outline Designer Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Outline Designer is one of the user experience modules for library management. A cross-site scripting vulnerability exists in Drupal Outline Designer versions 7.x-2.x prior to 7.x-2.3,...

Drupal RESTWS RCE Vulnerability (SA-CONTRIB-2016-040) - Active Check

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)

Drupal Module RESTWS 7.x - PHP Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution',...

Drupal Module RESTWS 7.x - Remote PHP Code Execution (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution', 'Description' = %q Th...

Drupal Coder RCE Vulnerability (SA-CONTRIB-2016-039) - Active Check

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; if...