Drupal Version Detection

Binary data 9209.prm...

Drupal Detected via Update Traffic

Binary data 9208.prm...

Drupal 6.x < 6.36 OpenID Security Bypass

Binary data 9214.prm...

Drupal 7.x < 7.38 Multiple Vulnerabilities

Binary data 9217.prm...

Drupal 7.x Detection

Binary data 9211.prm...

Drupal 6.x < 6.38 Multiple Vulnerabilities

Binary data 9216.prm...

Drupal 7.x < 7.39 Multiple Vulnerabilities

Binary data 9218.prm...

Drupal 7.x < 7.43 Multiple Vulnerabilities

Binary data 9220.prm...

Drupal 8.x Detection

Binary data 9212.prm...

Drupal Core HTTP headers SQL Injection

No description provided by source...

HybridAuth - Less critical - Multiple vulnerabilities - SA-CONTRIB-2016-018

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. Open redirect The module doesn't verify the "destination" redirect after a login to be a non-external URL causing an ope...

Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019

This module enables you to build an online store that uses nodes to display products through the use of product reference fields. The default widget for those fields is an autocomplete textfield similar to the taxonomy term reference field's autocomplete widget. As you type in the textfield, the...

Drupal Core Reflected File Download Vulnerability

Drupal is a free and open source content management system developed in PHP. A reflected file download vulnerability exists in Drupal Core. Allows an attacker to trick users into downloading and running arbitrary JSON file encoded content...

Drupal Core HTTP Header Injection Vulnerability

Drupal is a free and open source content management system developed in PHP. An HTTP header injection vulnerability exists in the Drupal Core 'drupalsetheader' function. An attacker can exploit the vulnerability to conduct HTTP header injection attacks...

Drupal Core Session Data Hijacking Vulnerability

Drupal is a free and open source content management system developed in PHP. A session data hijacking vulnerability exists in Drupal Core. In some older versions of PHP, user-supplied session data stored in Drupal could be serialized, leading to remote code execution...

Multiple vulnerabilities in Drupal Core File module

Drupal is a free and open source content management system developed in PHP. A file upload bypass and denial of service vulnerability exists in the Drupal Core File module. This allows a malicious user to view, delete or replace a link to a file that the victim has uploaded to a form that has not...

Drupal Core Forms Interface Ignores Submit Button Access Restriction Vulnerability

Drupal is a free and open source content management system developed in PHP. An access bypass vulnerability exists in Drupal Core. Allowing input submission, e.g. using JavaScript, of form button elements that the user should not have access to because the buttons are blocked by server-side form...

Drupal Core double-encoded 'destination' parameter open redirect vulnerability

Drupal is a free and open source content management system developed in PHP. An open redirection vulnerability exists in the Drupal Core double encoding of the 'destination' parameter.The Drupal 6 'drupalgoto' function fails to correctly decode the content of $REQUEST'destination' when used,...

Drupal Core Violence Amplification Attack Vulnerability

Drupal is a free and open source content management system developed in PHP. A brute force amplification attack vulnerability exists in Drupal Core.The XML-RPC system allows a large number of calls to the same method to be done once, which can be used as a factor in favor in a brute force attack...

Drupal Core Information Disclosure Vulnerability (CNVD-2016-01931)

Drupal is a free and open source content management system developed in PHP. Drupal Core has a security vulnerability. In some configurations, a user's email address can be used to log in instead of their username, and a link to "Forgot Password" can display the username associated with a specifi...