PT-2024-9307 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Drupal Core versions 11.0.0 through 11.0.7 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This c...

Drupal core 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7 - Unauthenticated Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Core Drupal versions 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7...

PT-2024-10480 · Drupal · Node Export

Name of the Vulnerable Software and Affected Versions: Drupal Node export versions 7.X- through 7.X-3.2 Description: The issue is related to the deserialization of untrusted data in the Node export module of the Drupal CMS, which can lead to object injection. This allows a remote attacker to...

Drupal Mailjet module < 4.0.1 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Drew Webber in WordPress Module Mailjet versions 4.0.1...

PT-2024-10230 · Drupal · Drupal Mailjet

Name of the Vulnerable Software and Affected Versions: Drupal Mailjet versions 0.0.0 through 4.0.0 Description: The issue is related to the deserialization mechanism in the Mailjet module of the Drupal CMS system. It allows for the deserialization of untrusted data, leading to object injection...

PT-2024-10088 · Oracle · Eloqua

Name of the Vulnerable Software and Affected Versions: Eloqua versions 7.X- through 7.X-1.15 Description: The issue is related to the deserialization of untrusted data in Drupal Eloqua, allowing object injection. This can be exploited by a remote attacker to execute arbitrary code. The estimated...

PT-2024-9339 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.8.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: The issue is related to insufficient protection of the web page structure, allowing an attacker to...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized...

Drupal core 8.8.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Jay Beaton in WordPress Core Drupal versions 8.8.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7...

Drupal core 7.0-7.101.0 - Unauthenticated Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross Site Scripting XSS vulnerability discovered by Cesar in WordPress Core Drupal versions 7.0-7.101.0...

Drupal core 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7 - Unauthenticated Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Core Drupal versions 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7...

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to...

Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allo...

Drupal 7.x < 7.102 / 10.2.x < 10.2.11 / 10.3.x < 10.3.9 / 11.x < 11.0.8 Multiple Vulnerabilities (drupal-2024-11-20)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.102, 10.2.x prior to 10.2.11, 10.3.x prior to 10.3.9, or 11.x prior to 11.0.8. It is, therefore, affected by multiple vulnerabilities. - Deserialization of Untrusted Data vulnerabilit...

Drupal Node export module < 7.x-3.3 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Drew Webber in WordPress Module Node export versions 7.x-3.3...

Drupal core 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Wayne Eaker in WordPress Core Drupal versions 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7...

Drupal core 7.0-7.101.0,8.0.0-10.2.10,10.3.0-10.3.8 - Unauthenticated Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Core Drupal versions 7.0-7.101.0,8.0.0-10.2.10,10.3.0-10.3.8...

PT-2024-9323 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can...

Drupal Eloqua module < 7.x-1.15 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Drew Webber in WordPress Module Eloqua versions 7.x-1.15...

Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

This module allows users to export nodes and then import it into another Drupal installation, or on the same site. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize function, which could results in Remote Code Execution via PHP Object Injection...