Monitoring Drupal with OSSEC - It is possible to monitor your Drupal site using OSSEC, the open source host based intrusion detection system, by implementing a custom decoder and a few simple rules.
Drupal FileField 6.x-3.3 XSS Vulnerability - The Drupal FileField module contains a cross site scripting (XSS) vulnerability due to the fact that it fails to sanitize image filenames before display.
Drupal Ctools 6.x-1.3 Multiple Vulnerabilities - Drupal Ctools module version 6.x-1.3 contains multiple vulnerabilities, including arbitrary PHP exection, access bypass, and cross site request forgery.
Drupal Context Module XSS - The Context module contains a cross site scripting (XSS) vulnerability because it fails to sanitize block descriptions before display.
Drupal Better Formats 6.x-1.2 XSS Vulnerability - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL. The Drupal Better Formats module (http://drupal.org/project/better_formats) contains a cross site scripting (XSS) vulnerability due to the fact that it fails
Auditing Drupal Modules for XSRF Vulnerabilities - Cross site request forgery (CSRF (pronounced sea-surf) or XSRF) is a trust exploitation that shares many similarities with cross site scripting (XSS).
Using Drupal XML-RPC to Bypass Authentication Failure Detection - Drupal provides robust, and largely ignored, XML remote procedure call (RPC) functionality. This functionality is available through the xmlrpc.php file that is available at the Drupal root in any installation. Any module can provide a hook into the XMLR
Drupal Zen Theme 6.x-1.1 XSS Vulnerability - Drupal is a robust content management system (CMS) written in PHP and MySQL that provides custom look and feel functionality with themes. The popular Zen theme contains a cross site scripting vulnerability due to the fact that it fails to properly saniti
Securing Drupal User Accounts - Securing a default Drupal installation takes some work and forethought. Drupal's native functionality creates a number of vulnerabilities that can only be mitigated through careful configuration.
Drupal Help Injection Module XSS Vulnerability - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that provides extensibility through hundreds of third party modules. The Advanced Help Injection and Export Module (http://drupal.org/project/helpinject) \
Drupal Twitter Module Credential Exposure - The Twitter Module suffers from potential vulnerability due to the fact that it could expose stored Twitter account credentials to theft or exposure.
Brute Forcing Drupal - Brute forcing account credentials for Drupal 5 and 6 sites including a sample script.
Drupal Sections Module 6.x-1.2 XSS Vulnerability - The Sections module contains a cross site scripting vulnerability because it does not properly sanitize output of section names before display.
Monitoring Drupal for Insecure Settings - The Drupal content management system (CMS) is a wonderful for maintaining multiple, user driven and owned websites. From a security context, however, Drupal can present a challenge.
Drupal CCK 5.x-1.10 XSS Vulnerability - The CCK module version 5.x-1.10 contains a cross site scripting vulnerability because it does not properly sanitize output of group labels before display.
Drupal ImageCache 6.x-2.0-beta9 Multiple XSS Vulnerability - The Drupal ImageCache module version 6.x-2.0-beta9 contains several cross site scripting vulnerabilities because it does not properly sanitize output of action preset values before display.
Drupal 5 to 6 Upgrade - Drupal supports two versions at any given time (a major and a minor).
Drupal Biblio Module 6.x-1.5 XSS Vulnerability - The Drupal Biblio module version 6.x-1.5 contains a cross site scripting vulnerability because it does not properly sanitize output of titles before display.
Drupal Date 6.x-2.2 and Calendar 6.x-2.1 XSS Vulnerability - The Drupal Calendar module version 6.x-2.2 suffers from a cross site scripting (XSS) vulnerability due to the fact that it does not properly sanitize names during display.
Drupal NodeQueue 6.x-2.1 XSS Vulnerability - The NodeQueue module version 6.x-2.1 suffers from a cross site scripting (XSS) vulnerability due to the fact that it does not properly sanitize taxonomy names during display.
Drupal Email Field 6.x-1.1 XSS Vulnerability - The Drupal Email Field module version 6.x-1.1 contains a cross site scripting vulnerability due to the fact that it fails to sanitize help text entered by users during content type configuration.
Drupal Content Access Module XSS Fun - Asking me about computer security and privacy is probably a lot like asking a law enforcement agent about home security - you're going to get an answer colored by experience.
Is Drupal Ready for the Enterprise? - Although Drupal has many of the trappings of an enterprise level CMS such as dedicated development and security teams, commercial backing from companies like Acquia and others, it may not be fully ready for the enterprise.
Drupal CCK 6.x-2.2 XSS Vulnerability - The Drupal CCK module version 6.x-2.2 contains a vulnerability that could allow an authenticated attacker to inject arbitrary script into administration screens for content types.
Dangers of Drupal Cron - The Drupal default installation and configuration presents several security challenges and potential vulnerabilities with scheduling cron.
Drupal Password Reset via XSS - The Drupal account page contains a flaw, which combined with a well crafted XSS attack, could be used to change a user's password to an arbitrary value.
Drupal Security Team Ignores Multiple XSS Vulnerabilities - The Drupal security team's rather disappointing advice to rectify this situation was not to fix the vulnerabilities in the module code in question, but rather to limit the scope of users granted 'administer content types' privileges.
Drupal Leaking Version Information - Upon installation Drupal relies on a functioning .htaccess file to protect critical module information, but Drupal will function even if the .htaccess protections aren't working properly.
Developing Drupal Module Exploits - While the Drupal security team does a great job of making sure the core modules distributed with Drupal are secure, there are a host of third party contributed modules that often contain security problems.