CVE-2017-6927

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous text before outputting it to HTML as JavaScript output does not typically go through Twig autoescaping. This function does not correctly...

CVE-2017-6927: Improper Neutralization of Input During Web Page Generation

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous text before outputting it to HTML as JavaScript output does not typically go through Twig autoescaping. This function does not correctly...

PT-2018-8351

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Drupal versions 7.x before 7.57 Description The issue arises from the Drupal.checkPlain JavaScript function, which is intended to escape potentially dangerous text before it is outputted to HTML. However, thi...

CVE-2008-1133: Improper Neutralization of Input During Web Page Generation

The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting XSS attacks...