14426 matches found
Detection of Error Condition Without Action
Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to a bug in the CKEditor 5 module that incorrectly handles image uploads. An...
GHSA-52JR-X6H6-XJ6G Drupal core vulnerable to improper error handling
Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...
Infinite loop
Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Infinite loop via the Comment module. An attacker can trigger excessive resource consumption by making repeated comment reply...
CVE-2024-11941
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8...
CVE-2024-11942
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
UBUNTU-CVE-2024-11942
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
UBUNTU-CVE-2024-11941
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8...
CVE-2024-11942
CVE-2024-11942 is a Drupal Core vulnerability that enables file manipulation in Drupal Core versions 10.0.0 up to (but not including) 10.2.10. Impact and root cause are not detailed in the provided documents, but multiple sources corroborate the issue. Affected releases should upgrade to Drupal C...
CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
CVE-2024-11941
CVE-2024-11941 describes a vulnerability in Drupal Core causing excessive allocation. Affected versions: Drupal Core 10.2.0 up to, but not including, 10.2.2, and 10.1.0 up to, but not including, 10.1.8. The issue is tied to a resource over-allocation condition in the core. The provided documents ...
CVE-2024-11941 Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8...
CVE-2024-11941 Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8...
CVE-2024-11941 Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8...
Drupal 安全漏洞
Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal versions 8.0.X prior to 10.1.8 and 10.2.X prior to 10.2.2, which stems from a vulnerability that allows for over-allocation...
Drupal 安全漏洞
Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal version 10.0.X prior to 10.2.10, which stems from the presence of an allowed file manipulation vulnerability...
DRUPAL-CONTRIB-2024-071
This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code. This vulnerability is mitigated by the fact...
DRUPAL-CONTRIB-2024-069
This module provides a field formatter for the field type 'file' called Table of files with download all link . The module had vulnerabilities allowing a user to download files they normally should not be able to download...