DRUPAL-CONTRIB-2024-067

This module enables you to authenticate users through an Identity Provider IdP or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is...

PT-2024-10138 · Drupal · Megamenu Framework

Name of the Vulnerable Software and Affected Versions: Megamenu Framework versions . Description: The issue is related to insufficient input validation in the Megamenu Framework module of the Drupal CMS, which can be exploited by a remote attacker to execute arbitrary code. Recommendations: For...

Drupal Megamenu Framework module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Module Megamenu Framework versions...

PT-2024-10092 · Drupal · Drupal +1

Name of the Vulnerable Software and Affected Versions: Drupal Pages Restriction Access versions 2.0.0 through 2.0.2 Description: The issue is related to an incorrect authorization mechanism in the Pages Restriction Access module of the Drupal CMS system. This allows a remote attacker to bypass...

Drupal OAuth & OpenID Connect Login - OAuth2.0 Client SSO Login module 3.0.0-3.43.0,4.0.0-4.0.18 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Drupal OAuth & OpenID Connect Login - OAuth2.0 Client SSO Login module 3.0.0-3.43.0,4.0.0-4.0.18 - Unauthenticated Cross Site Scripting XSS vulnerability discovered by Borut Piletic in WordPress Module OAuth & OpenID Connect Login - OAuth2.0 Client SSO Login versions 3.0.0-3.43.0,4.0.0-4.0.18...

OAuth Client & OpenID Connect SSO | OAuth/OIDC Login - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

This module enables you to authenticate users through an Identity Provider IdP or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is...

PT-2024-10135 · Drupal · Drupal Browser Back Button

Name of the Vulnerable Software and Affected Versions: Drupal Browser Back Button versions 1.0.0 through 2.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can enable a remote attacker to conduct...

PT-2024-10085 · Drupal · Download All Files

Name of the Vulnerable Software and Affected Versions: Download All Files versions 0.0.0 through 2.0.1 Description: The issue is related to a Missing Authorization vulnerability in the Download All Files module for the Drupal CMS, which allows for Forceful Browsing. This vulnerability can be...

PT-2024-10084 · Drupal +1 · Drupal +1

Name of the Vulnerable Software and Affected Versions: Minify JS versions 0.0.0 through 3.0.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Minify JS module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to perform ...

PT-2024-10232 · Drupal · Drupal Oauth & Openid Connect Single Sign On – Sso

Name of the Vulnerable Software and Affected Versions: Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client versions 3.0.0 through 3.43.0 Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client versions 4.0.0 through 4.0.18 Description: The issue is related to imprope...

Drupal Download All Files module < 2.0.2 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff in WordPress Module Download All Files versions 2.0.2...

PT-2024-10087 · Drupal · Drupal Entity Form Steps

Name of the Vulnerable Software and Affected Versions: Drupal Entity Form Steps versions 0.0.0 through 1.1.3 Description: The issue is related to improper neutralization of input during web page generation, allowing for Cross-Site Scripting XSS attacks. This can enable a remote attacker to conduc...

Drupal Print Anything module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Module Print Anything versions...

PT-2024-10137 · Drupal · Print Anything +1

Name of the Vulnerable Software and Affected Versions: Print Anything versions . Description: The issue is related to insufficient input validation in the Print Anything module of the Drupal CMS system. This can allow a remote attacker to execute arbitrary code. The problem affects all versions o...

DRUPAL-CONTRIB-2024-064

This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Administrators can enable and configure services which will be managed by Tarte au citron. When Google Tag Manager GTM service is enabled, an attacker can load a GTM container tha...

Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Administrators can enable and configure services which will be managed by Tarte au citron. When Google Tag Manager GTM service is enabled, an attacker can load a GTM container tha...

Drupal 10.3.x < 10.3.9 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. - Drupal core...

Drupal 10.2.x < 10.2.11 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. - Drupal core...

Drupal 11.0.x < 11.0.8 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. - Drupal core...

Drupal PHP Object Injection Vulnerability (SA-CORE-2024-008) - Linux

Drupal is prone to a PHP object injection vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...