448 matches found
Drupal 8.8.x < 8.8.10 Multiple Vulnerabilities
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6 or 9.0.x prior to 9.0.6. It is, therefore, affected by multilple vulnerabilities : - A Cross-Site Scripting XSS due to Drupal AJAX AP...
DRUPAL-CORE-2020-008
The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass...
PT-2020-13648 · Drupal · Drupal Core
Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 8.8.10 Drupal Core versions prior to 8.9.6 Drupal Core versions prior to 9.0.6 Description: The issue is an access bypass vulnerability in the Workspaces module of Drupal Core, which fails to properly check acces...
Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008
The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass...
CVE-2020-2214
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
unisonworkspaces.co.nz Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1188078 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2019-6342
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
CVE-2019-6342
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
Security feature bypass
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
UBUNTU-CVE-2019-6342
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
CVE-2019-6342
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
CVE-2019-6342 Drupal core - Critical - Access bypass - SA-CORE-2019-008
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
CVE-2019-6342
CVE-2019-6342 affects Drupal 8.7.4 where an access bypass occurs when the experimental Workspaces module is enabled. The vulnerability is caused by the Workspaces module’s presence in Drupal core, allowing bypass of security checks (no other Drupal releases are affected). Mitigation available: di...
CVE-2019-6342
Removed by vendor...
CVE-2019-6342: Undefined Security Weakness
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...
PT-2020-11206 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal 8 version 8.7.4 Description: An access bypass issue exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. Recommendations: For Drupal 8 version 8.7.4,...
Matrix42 Workspace Management 9.1.2.2765 Cross Site Scripting Vulnerability
Matrix42 Workspace Management version 9.1.2.2765 suffers from a persistent cross site scripting vulnerability. Matrix42 Workspace Management 9.1.2.2765 – Stored Cross-Site Scripting =============================================================================== Identifiers...
Moderate: Red Hat Security Advisory: Red Hat CodeReady Workspaces 2.1.0 release
Red Hat CodeReady Workspaces 2.1.0 has been released. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in th...
Authorization Bypass
drupal/drupal is vulnerable to authorization bypass. The vulnerability exists when the experimental Workspaces is enabled as Drupal does not properly check if the user owns the workspace...
Drupal (SA-CORE-2019-008) Wordspaces Extension Access Bypass PoC
PenTestIT RSS Feed Last week, an advisory SA-CORE-2019-008 addressing a Drupal access bypass vulnerability was made public. MITRE assigned CVE-2019-6342 to this critical vulnerability. This is post to document the steps I took to create a PoC for SA-CORE-2019-008. Last such post on this blog was...