Fedora 29 : drupal7 (2019-040857fd75)

https://www.drupal.org/project/drupal/releases/7.67 - SA-CORE-2019-007 CVE-2019-11831 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Exploit for Deserialization of Untrusted Data in Drupal

CVE-2019-6340 Drupal8's REST RCE, SA-CORE-2019-003 0x01 d...

Intel Active Management Technology Multiple Vulnerabilities (INTEL-SA-00213)

Multiple potential security vulnerabilities in Intel Active Management Technology AMT may allow escalation of privilege, information disclosure, and/or denial of service DoS. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Workflow - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-049

The Workflow module enables you to create arbitrary Workflows, and assign them to Entities. The module doesn't sufficiently escape HTML in the field settings leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Drupal 8.7.x < 8.7.1 Third-Party Libraries Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.6.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or...

Drupal 7.x < 7.67 Third-Party Libraries Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.6.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or...

Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...

EulerOS Virtualization 3.0.1.0 : openssh (EulerOS-SA-2019-1426)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, whi...

Drupal Third-party Libraries Vulnerability (SA-CORE-2019-007) - Linux

Drupal is prone to a vulnerability in the 3rd party library Phar Stream Wrapper. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 29 : drupal8 (2019-7eaf0bbe7c)

https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911 - https://www.drupal.org/SA-CORE-2019-006 CVE-2019-11358 - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has...

Fedora 28 : drupal8 (2019-1a3edd7e8a)

https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911 - https://www.drupal.org/SA-CORE-2019-006 CVE-2019-11358 - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has...

Drupal 7.0.x < 7.67 / 8.6.x < 8.6.16 / 8.7.x < 8.7.1 Drupal Vulnerability (SA-CORE-2019-007)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.7.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or...

AIS Logistics ESEL-Server SQL Injection / Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AIS logistics ESEL-Server Unauth SQL Injection RCE', 'Description' = %q This module will execute an arbitrary payload on an "ESEL" server used by...

Drupal jQuery XSS Vulnerability (SA-CORE-2019-006) - Windows

Drupal is prone to a cross-site scripting vulnerability in jQuery. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"...

Drupal jQuery XSS Vulnerability (SA-CORE-2019-006) - Linux

Drupal is prone to a cross-site scripting vulnerability in jQuery. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"...

TableField - Critical - Remote Code Execution - SA-CONTRIB-2019-045

This module allows you to attach tabular data to an entity. The module doesn't sufficiently determine that the data being unserialized is the contents of a tablefield when users request a CSV export, which could lead to Remote Code Execution via Object Injection. This vulnerability is mitigated b...

Apple iOS < 11.0 Multiple Vulnerabilities (APPLE-SA:APPLE-SA-2017-09-19-1)

Binary data 700541.prm...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006

The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes: jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extendtrue, , .... If an unsanitized source object...

Apple iOS < 11.2.2 Multiple Vulnerabilities (Spectre, APPLE-SA-2018-1-8-1)

Binary data 700545.prm...

Drupal Releases Security Updates

Drupal has released security updates to address multiple vulnerabilities in Drupal Core. A remote attacker could exploit some of these vulnerabilities to take control of an affected website. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review...