My Drupal 7.28 site has been hacked through the the tmp dir which was not protected by .htaccess file. The hacker managed to delete the main .htaccess file and upload some bogus google docs 2014 ...
We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
In a Drupal site, I get this error in my Debian's syslog: suhosin: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file ...
Drupal filters HTML strings against XSS attacks using regexes: http://api.drupal.org/api/drupal/includes%21common.inc/function/filter_xss/7 However, as a lot of people know, HTML can't be parsed with ...
I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...