CVE-2017-6919

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...

Remote code execution

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...

CVE-2017-6381

CVE-2017-6381 corresponds to a Drupal RCE via the PHPUnit component bundled with Drupal 8 development dependencies. Affected if running Drupal versions before 8.2.2; mitigation in the public description notes that .htaccess generally blocks PHP execution and that Composer development dependencies...

Drupal 8.x < 8.2.3 Multiple Vulnerabilites

Binary data 9821.prm...

CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

Default credentials

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...

Design/Logic Flaw

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...

CVE-2016-9452

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...

CVE-2016-9452

CVE-2016-9452 affects Drupal Core via the transliterate mechanism in Drupal 8.x (pre-8.2.3). A specially crafted URL can cause a denial of service, potentially stopping the application. Affected product: Drupal Core 8.x before 8.2.3. Root cause: issue in transliterate handling that can be trigger...

CVE-2016-9452

Removed by vendor...

CVE-2016-9450

Removed by vendor...

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...

CVE-2016-7571

Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...

CVE-2016-7572

The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...

CVE-2016-7570

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...

CVE-2016-7570

Vulnerability: Drupal 8.x before 8.1.10 exposes a permissions check flaw where users with node-edit rights can alter the visibility of comments on arbitrary nodes. Root cause: improper verification of the Administer comments permission. Impact: authenticated remote attackers could manipulate comm...

CVE-2016-7572

CVE-2016-7572 affects Drupal 8.x prior to 8.1.10, where the system.temporary route does not properly enforce the Export configuration permission, allowing remote authenticated users to bypass restrictions and read the full config export. Impact is sensitive information disclosure via an authentic...

CVE-2016-7571

CVE-2016-7571 is a Drupal XSS vulnerability affecting Drupal 8.x before 8.1.10. The issue allows remote attackers to inject arbitrary script or HTML via vectors related to handling HTTP exception messages. Documents corroborate the vulnerability under multiple sources (NVD entry, GHSA advisory, N...