CVE-2024-13248 Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0...

CVE-2024-13248

CVE-2024-13248 is a privilege-assignment flaw in Drupal Private content (SA-CONTRIB-2024-012). The vulnerability arises from incorrect permission handling when private content is framed, enabling target influence and an access bypass for content in versions before 2.1.0. Affected product: Drupal ...

CVE-2024-13247

CVE-2024-13247 concerns the Drupal Coffee module (versions 0.0.0 through 1.3.x; prior to 1.4.0). The root cause is improper neutralization/escaping of user input during web page generation, leading to Cross-Site Scripting (XSS) when Coffee renders certain content. The public documentation consist...

CVE-2024-13247 Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2024-13247 Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2...

CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2...

CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2...

CVE-2024-13246

CVE-2024-13246 concerns Drupal’s Node Access Rebuild Progressive module. The vulnerability stems from improper ownership management in the module, which can allow a remote attacker to bypass access controls and influence the target via framing. Affected versions are 0.0.0 through 2.0.1 (up to but...

CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting XSS.This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1...

CVE-2024-13244

CVE-2024-13244 concerns Drupal Migrate Tools, a Drupal module for migrations. Multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in Migrate Tools, affecting versions 0.0.0 through 6.0.2 (vulnerability before 6.0.3). The underlying issue allows an authenticated administrato...

CVE-2024-13244 Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

Cross-Site Request Forgery CSRF vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243

CVE-2024-13243: In Drupal, the Entity Delete Log module (versions 0.0.0 through 1.1.1) suffers a missing authorization vulnerability that enables forceful browsing and an access bypass to log information. The issue is rooted in insufficient permissions handling for the log view/report page, enabl...

CVE-2024-13242 Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer:...

CVE-2024-13241 Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5...

CVE-2024-13241

CVE-2024-13241 affects the Drupal Open Social distribution. Open Social versions 0.0.0 through 12.0.4 contain an improper authorization flaw that enables collecting data from common resource locations, resulting in information disclosure. The vulnerability is tied to the authorization controls in...

CVE-2024-13241 Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5...