DRUPAL-CONTRIB-2024-026

The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access ...

Drupal View Password module < 6.0.4 - Administrator+ Cross Site Scripting (XSS) vulnerability

Administrator+ Cross Site Scripting XSS vulnerability discovered by Ide Braakman in WordPress Module View Password versions 6.0.4...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

UBUNTU-CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481

CVE-2024-34481 affects Drupal Wiki prior to 8.31.1 and is described as allowing cross-site scripting (XSS) via comments, captions, and image titles on a Wiki page. The connected sources (Red Hat, Ubuntu, OSV, CVE listings) consistently report the same description. The root cause details are not e...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

Drupal Wiki Security Vulnerabilities

Drupal Wiki is a free and open source content management system from Drupal Wiki, Inc. A security vulnerability exists in Drupal Wiki versions prior to 8.31.1, which stems from allowing cross-site scripting XSS attacks via comments, titles, and image captions on Wiki pages...

CVE-2024-34481

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...

MAL-2024-6877 Malicious code in drupal-fu (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in drupal-fu (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in cap_drupal-multisite (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Cross Site Scripting (XSS)

drupal/drupal is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the issues in the CKEditor library when configured for WYSIWYG editing, allowing attackers to target users with access to CKEditor, including privileged site admins...

DRUPAL-CONTRIB-2024-025

Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficientl...

Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficientl...

PT-2024-10363 · Acquia · Acquia Dam

Name of the Vulnerable Software and Affected Versions: Acquia DAM versions 0.0.0 through 1.0.12 Acquia DAM versions 1.1.0 through 1.1.0-beta2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Acquia DAM module of the Drupal CMS system. This vulnerability...

Drupal Acquia DAM module < 1.0.13,1.1.0-1.1.0-beta2 - Unauthenticated Multiple Vulnerabilities

Unauthenticated Multiple Vulnerabilities discovered by Matt Glaman in WordPress Module Acquia DAM versions 1.0.13,1.1.0-1.1.0-beta2...

Symfony2 improper IP based access control

Damien Tournoud, from the Drupal security team, contacted us two days ago about a security issue in the Request::getClientIp method when the trust proxy mode is enabled Request::trustProxyData. An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp...

DRUPAL-CONTRIB-2024-023

This module enables you to create responsive image styles that depend on the parent element's width. The module doesn't sufficiently check access to rendered images, resulting in access bypass vulnerabilities in specific scenarios...