4394 matches found
Fedora 28 : drupal8 / php-typo3-phar-stream-wrapper2 (2019-6a0717dc9a)
drupal8 Upstream : - https://www.drupal.org/project/drupal/releases/8.6.10 - https://www.drupal.org/SA-CORE-2019-003 - https://www.drupal.org/project/drupal/releases/8.6.9 - https://www.drupal.org/project/drupal/releases/8.6.8 - https://www.drupal.org/project/drupal/releases/8.6.7 -...
EulerOS Virtualization 2.5.2 : bind (EulerOS-SA-2019-1081)
According to the version of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - 'deny-answer-aliases' is a little-used feature intended to help recursive server operators protect end users against DNS rebinding...
CVE-2013-7468
Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...
Drupal CVE-2019-6340 Remote Code Execution EXP
Description This Metasploit module exploits a PHP unserialize vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also...
FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FreeBSD Intel SYSRET Privilege Escalation', 'Description' = %q This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit...
Drupal RESTful Web Services unserialize() Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal RESTful Web Services unserialize RCE', 'Description' = %q This module exploits a PHP unserialize vulnerability in Drupal RESTful Web...
Drupal voor Gemeenten - Moderately critical - Access Bypass - SA-CONTRIB-2019-031
The DvG distrubition contains the feature module dvgdomains to support multiple domains. When the dvgdomains feature module is enabled, anonymous users are able to access some administration pages and change the settings exposed on those pages. This issue can be mitigated by disabling the...
Drupal RESTful Web Services unserialize() Remote Code Execution Exploit
This Metasploit module exploits a PHP unserialize vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also vulnerable albei...
Drupal Remote Code Execution Vulnerability (SA-CORE-2019-003) (exploit)
Binary data drupalCVE-2019-6340rce.nbin...
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability (cisco-sa-20190227-rmi-cmd-ex)
According to its self-reported version, the version of the Cisco Small Business Wireless-N VPN Router installed on the remote host is affected by a remote command execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands ...
Facets - Moderately critical - Cross site scripting - SA-CONTRIB-2019-030
This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by two factors. First, an attacker must have...
Path Breadcrumbs - Moderately critical - Cross site scripting - SA-CONTRIB-2019-027
This module enables you to configure breadcrumbs for any Drupal page. This module doesn't properly sanitize custom breadcrumb configuration in all cases, leading to an XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer...
Drupal RCE Vulnerability (SA-CORE-2019-003) - Active Check
Drupal is prone to a remote code execution RCE vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
Drupal RCE Vulnerability (SA-CORE-2019-003) - Windows
Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Drupal RCE Vulnerability (SA-CORE-2019-003) - Linux
Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
DRUPAL-CONTRIB-2019-023
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003
Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services rest module enabled and allows GET, PAT...
RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2019-018
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...
Translation Management Tool - Critical - Remote Code Execution - SA-CONTRIB-2019-024
This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details...