CVE-2024-13280

Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0. before 2.2.2...

CVE-2024-13279

Session Fixation vulnerability in Drupal Two-factor Authentication TFA allows Session Fixation.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.8.0...

CVE-2024-13271

Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4...

CVE-2024-13266

Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4...

CVE-2024-13287 Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting XSS.This issue affects Views SVG Animation: from 0.0.0 before 1.0.1...

CVE-2024-13280 Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0. before 2.2.2...

CVE-2024-13280

The CVE concerns the Drupal Persistent Login module and an insufficient session expiration vulnerability that allows forceful browsing (access bypass). Affected versions are 0.0.0–before 1.8.0 and 2.0.* before 2.2.2. The root cause, as described in linked advisories, is improper session/cookie ha...

CVE-2024-13280 Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0. before 2.2.2...

CVE-2024-13278 Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0...

CVE-2024-13277

CVE-2024-13277 affects the Drupal Smart IP Ban module (versions 7.X-1.0 through 7.X-1.1). The issue is improper/incorrect authorization enabling forceful browsing to view/modify module settings or restricted paths. Root cause: insufficient authorization controls in the Smart IP Ban plugin. Impact...

CVE-2024-13276 File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity fieldable files allows Forceful Browsing.This issue affects File Entity fieldable files: from 7.X- before 7.X-2.39...

CVE-2024-13275 Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3...

CVE-2024-13275 Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3...

CVE-2024-13272

CVE-2024-13272 affects the Drupal Paragraphs table module. Root cause: insufficient granularity of access control leading to content spoofing (and related information disclosure). Affected: Paragraphs table versions 0.0.0–1.22.0 and 2.0.0–2.0.1. Impact: possible bypass of access controls and disc...

CVE-2024-13271 Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4...

CVE-2024-13271

The vulnerability CVE-2024-13271 affects Drupal’s Content Entity Clone module. The issue is incorrect authorization that allows forceful browsing and potential disclosure of protected information. Affected versions are 0.0.0 through 1.0.4 of the Content Entity Clone module. Remediation per the co...

CVE-2024-13271 Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4...

CVE-2024-13269 Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11...

CVE-2024-13269

Summary: CVE-2024-13269 is a vulnerability in Drupal Advanced Varnish causing insertion of sensitive information into sent data, enabling forceful browsing. Affected product/version: Advanced Varnish 0.0.0 up to 4.0.10 (i.e., before 4.0.11). Impact (as per sources): potential information disclosu...

CVE-2024-13267

The Drupal Opigno TinCan Question Type module (7.X-1.0 through 7.X-1.3) is affected by SA-CONTRIB-2024-031, describing improper neutralization of directives in statically saved code that enables a static code injection vulnerability. This can allow Remote Code Execution (RCE) and/or Cross Site Sc...