CVE-2024-13286

The Drupal SVG Embed module (versions 0.0.0 through 2.1.2) is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. Specifically, the module fails to sufficiently sanitize SVG files before embedding them into the HTML body. A remote attacker can...

CVE-2024-13285 wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049

Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf:...

CVE-2024-13281 Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2...

CVE-2024-13279 Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

Session Fixation vulnerability in Drupal Two-factor Authentication TFA allows Session Fixation.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.8.0...

CVE-2024-13279 Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

Session Fixation vulnerability in Drupal Two-factor Authentication TFA allows Session Fixation.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.8.0...

CVE-2024-13279

The Drupal Two-factor Authentication (TFA) module (versions prior to 1.8.0 ) is vulnerable to Session Fixation due to improper session management. Specifically, the module fails to sufficiently migrate sessions before prompting for a second factor token. A successful exploit could allow a malicio...

CVE-2024-13275

The Drupal Security Kit module (versions 0.0.0 through 2.0.2 ) is vulnerable to a Type Confusion issue caused by accessing a resource using an incompatible type. A remote attacker can exploit this vulnerability to trigger a Denial of Service (DoS) via HTTP. This issue is mitigated if the site doe...

CVE-2024-13275 Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3...

CVE-2024-13270

The Freelinking module for the Drupal CMS is affected by an Incorrect Authorization vulnerability (CVE-2024-13270) in versions 0.0.0 through 4.0.0 . The root cause is that the module fails to sufficiently check if a user has access to specific URLs before rendering them as links. This allows a re...

CVE-2024-13268

The Opigno module for Drupal (versions 7.X-1.0 before 7.X-1.23 ) is vulnerable to Static Code Injection due to improper neutralization of directives in statically saved code. This flaw can lead to PHP Local File Inclusion and, according to related reports (BDU:2025-00267), allows for Remote Code ...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13237

The Drupal File Entity (fieldable files) module (versions 7.X- through 7.X-2.38 *) contains an Improper Neutralization of Input During Web Page Generation vulnerability. This flaw allows attackers to bypass security restrictions and execute Cross-Site Scripting (XSS) attacks, including persistent...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Security Kit prior to version 2.0.3 that stems from accessing a resource using an incompatible type, resulting in type confusion...

CVE-2024-13275: Access of Resource Using Incompatible Type

Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3...

Drupal core Denial of Service

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service DOS. Sites that do not use the Comment module are not affected...

Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

This module for Drupal provides complete control of Email settings with Drupal and Mailjet. In certain cases the module doesn't securely pass data to PHP's unserialize function, which could result in Remote Code Execution via PHP Object Injection. This vulnerability is mitigated by the fact that ...

Drupal Security Kit module < 2.0.3 - Unauthenticated Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack vulnerability discovered by b0lli in WordPress Module Security Kit versions 2.0.3...

Symfony2 improper IP based access control

Damien Tournoud, from the Drupal security team, contacted us two days ago about a security issue in the Request::getClientIp method when the trust proxy mode is enabled Request::trustProxyData. An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp...

Drupal Releases Security Advisory for Drupal Core

Drupal released a security advisory to address a vulnerability affecting multiple Drupal core versions. A cyber threat actor could exploit this vulnerability to cause a denial-of-service condition. CISA encourages users and administrators to review Drupal security advisory SA-CORE-2024-001link is...

Drupal Releases Security Advisory to Address Vulnerability in Drupal Core

Drupal has released a security advisory to address a vulnerability affecting multiple Drupal versions. A malicious cyber actor could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Drupal security advisory SA-CORE- 2023-006link ...