CVE-2014-9022

The CVE-2014-9022 issue affects Drupal’s Webform Component Roles module: versions 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8. The root cause is that the module allows remote attackers to bypass the disabled restriction and modify read-only webform components via a crafted form. Impact is r...

Drupal Denial of Service Session Hijacking Patch

Details on a patched denial of service vulnerability in the open source Drupal content management system have been disclosed. The vulnerability, patched yesterday, could be abused to crash a website running on the CMS. Researchers Michael Cullum, Javier Nieto and Andres Rojas Guerrero reported th...

drupal: session hijacking and denial of service

Custom configured session.inc and password.inc need to be audited as well to verify if they are prone to the following vulnerabilities. More information can be found in the upstream advisory 0. - CVE-2014-9015 session hijacking Aaron Averill discovered that a specially crafted request can give a...

Fedora 20 : drupal7-ckeditor-1.16-2.fc20 (2014-14674)

7.x-1.16 - SA-CONTRIB-2014-098 - CKEditor - Cross Site Scripting XSS Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Drupal Core Web Application Detection

Binary data 8581.prm...

Drupal Releases Security Advisory

Drupal has released an advisory to address multiple vulnerabilities in Drupal core 6.x versions prior to 6.34 and Drupal core 7.x versions prior to 7.34, one of which could allow a remote attacker to cause a denial of service. US-CERT encourages users and administrators to review Drupal's Securit...

[SECURITY] Fedora 20 Update: drupal7-ckeditor-1.16-2.fc20

This module will allow Drupal to replace textarea fields with the CKEditor - a visual HTML editor 1, usually called a WYSIWYG editor. This HTML text edi tor brings many of the powerful WYSIWYG editing functions of known desktop edit ors like Word to the web. It's very fast and doesn't require any...

[SECURITY] Fedora 19 Update: drupal7-ckeditor-1.16-2.fc19

This module will allow Drupal to replace textarea fields with the CKEditor - a visual HTML editor 1, usually called a WYSIWYG editor. This HTML text edi tor brings many of the powerful WYSIWYG editing functions of known desktop edit ors like Word to the web. It's very fast and doesn't require any...

SA-CONTRIB-2014-112 - Node Field - Cross Site Scripting (XSS)

Node Field module allows you to add custom extra fields to single Drupal nodes. The module doesn't sufficiently sanitize user input for some of the module's internal fields. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create nodes. CVE...

SA-CONTRIB-2014-113 - Secure Password Hashes - Denial of Service

This module enables a more secure password storage for Drupal 6 by back-porting the code used in Drupal 7 core. A vulnerability in this API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive...

SA-CONTRIB-2014-115 - Form Builder - Cross-Site Scripting (XSS)

The Form Builder module enables users to build entire Form API structures through a graphical, AJAX-like interface. The module doesn't sufficiently sanitize form titles in some cases. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create forms...

SA-CONTRIB-2014-111 - Protected Pages - Password Protection Bypass

Protected Pages modules allows the administrator to secure any page in your website by password by configuring a add path and the associated password. The module did not sufficiently protect variations on the protected path. CVE identifiers issued CVE-2014-9024 Versions affected Protected Pages...

SA-CONTRIB-2014-114 - Tournament - Cross Site Scripting

This project allows you to create various types of tournaments as nodes and associated teams, tournaments, and matches. There are several cases in the project where an account username, node title, and team entity title are not correctly filtered before being displayed to a user. It is possible t...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006

Session hijacking Drupal 6 and 7 A specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session. This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS content "mixed-mode", but it is possible...

[SECURITY] Fedora 21 Update: drupal7-ckeditor-1.16-2.fc21

This module will allow Drupal to replace textarea fields with the CKEditor - a visual HTML editor 1, usually called a WYSIWYG editor. This HTML text edi tor brings many of the powerful WYSIWYG editing functions of known desktop edit ors like Word to the web. It's very fast and doesn't require any...

Code injection

The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors...

CVE-2012-2301

The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors...

CVE-2012-2301

The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors...

CVE-2012-2301

Ubercart for Drupal 6.x-2.x (

Drupal Core <= 7.32 - SQL Injection (PHP)

No description provided by source. ?php ----------------------------------------------------------------------------- Exploit Title: Drupal core 7.x - SQL Injection Date: Oct 16 2014 Exploit Author: Dustin Dörr Software Link: http://www.drupal.com/ Version: Drupal core 7.x versions prior to 7.32...