153 matches found
Drupal 7.x < 7.72 Multiple Vulnerabilities
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1 or 9.0.x prior to 9.0.1. It is, therefore, affected by multilple vulnerabilities : - A Cross-Site Request Forgery CSRF due to...
Cross-Site Request Forgery (CSRF)
drupal/drupal is vulnerable to cross-site request forgery CSRF. The Form API does not properly handle certain form input from cross-site requests, which allow remote attackers to submit requests on behalf of the authenticated user...
Drupal cross-site request forgery vulnerability (CNVD-2021-36607)
Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site request forgery vulnerability exists in the Drupal core Form API, which stems from the program failing to properly process form input. An attacker can exploit this vulnerabili...
Vulnerability fixed in Drupal
Drupal has fixed a vulnerability in the Form API of the Drupal Core. The vulnerability allows a remote malicious party to able to perform a Cross-Site Request Forgery attack XSRF. A successful attack could thereby lead to consequential damage such as the obtaining sensitive data from a domain to...
drupal -- Multiple Vulnerabilities
Drupal Security Team reports: The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...
Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...
Debian: Security Advisory (DLA-2162-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Drupalgeddon3: Third Critical Flaw Discovered
For the third time in the last 30 days, Drupal site owners are forced to patch their installations. As the Drupal team noted a few days ago, new versions of the Drupal CMS were released, to patch one more critical RCE vulnerability affecting Drupal 7 and 8 core. The vulnerability, code-named...
Drupal Form API command execution
Added: 04/25/2018 CVE: CVE-2018-7600 BID: 103534 Background Drupal is an open-source content management system written in PHP. Problem Insufficient sanitization on Form API AJAX requests could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Drupal 7.58, 8.3.9, 8.4.6,...
Drupal Form API command execution
Added: 04/25/2018 CVE: CVE-2018-7600 BID: 103534 Background Drupal is an open-source content management system written in PHP. Problem Insufficient sanitization on Form API AJAX requests could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Drupal 7.58, 8.3.9, 8.4.6,...
CVE-2016-3165
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "access" set to FALSE in the server-side form definition...
Design/Logic Flaw
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "access" set to FALSE in the server-side form definition...
CVE-2016-3165
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "access" set to FALSE in the server-side form definition...
CVE-2016-3165
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "access" set to FALSE in the server-side form definition...
CVE-2016-3165
The issue CVE-2016-3165 affects Drupal 6.x before 6.38 where the Form API fails to enforce access restrictions on submit buttons. The server-side form definition may mark a button as #access = FALSE, yet a form submission can still be accepted if the attacker has permission to submit the form, ef...
CVE-2016-3165
Removed by vendor...
FreeBSD : drupal -- multiple vulnerabilities (59a0af97-dbd4-11e5-8fa8-14dae9d210b8)
Drupal Security Team reports : - File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical - Brute force amplification attacks via XML-RPC XML-RPC server - Drupal 6 and 7 - Moderately Critical - Open redirect via path manipulation Base system - Drupal 6, 7...
drupal -- multiple vulnerabilities
Drupal Security Team reports: File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical Brute force amplification attacks via XML-RPC XML-RPC server - Drupal 6 and 7 - Moderately Critical Open redirect via path manipulation Base system - Drupal 6, 7 and 8 ...
Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001
File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical A vulnerability exists in the File module that allows a malicious user to view, delete or substitute a link to a file that the victim has uploaded to a form while the form has not yet been submitted...
