15708 matches found
Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079
Open Social is a Drupal distribution for online communities, which ships with a default module that allows users to enroll in events. The module doesn't sufficiently protect certain routes from Cross Site Request Forgery CSRF attacks. Users can be tricked into accepting or rejecting these...
CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor. The module doesn't sufficiently validate iframe sources under the scenario where a user embeds a video using the CKEditor YouTube integration leading...
Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077
This module enables you to generate Table of content of your pages given a configuration. The module doesn't sufficiently sanitise data attributes allowing persistent Cross-site Scripting XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to...
Hidden Malware Discovered in jQuery Migrate: A Stealthy Supply Chain Threat
Hidden Malware Discovered in jQuery Migrate: A Stealthy Supply Chain Threat By Trellix · June 18, 2025 This blog was also written by Trishaan Kalra Introduction What happens when a trusted open source library becomes a conduit for stealthy malware delivery? That question became reality when the...
TencentOS Server 2: pcs (TSSA-2022:0280)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0280 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
CVE-2025-48920
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal etracker allows Cross-Site Scripting XSS.This issue affects etracker: from 0.0.0 before 3.1.0...
CVE-2025-48918
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple Klaro allows Cross-Site Scripting XSS.This issue affects Simple Klaro: from 0.0.0 before 1.10.0...
CVE-2025-48920
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal etracker allows Cross-Site Scripting XSS.This issue affects etracker: from 0.0.0 before 3.1.0...
CVE-2025-48919
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple Klaro allows Cross-Site Scripting XSS.This issue affects Simple Klaro: from 0.0.0 before 1.10.0...
CVE-2025-48917
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal EU Cookie Compliance GDPR Compliance allows Cross-Site Scripting XSS.This issue affects EU Cookie Compliance GDPR Compliance: from 0.0.0 before 1.26.0...
CVE-2025-48914
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...
CVE-2025-48915
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...
CVE-2025-48916
Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13...
CVE-2025-48917
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal EU Cookie Compliance GDPR Compliance allows Cross-Site Scripting XSS.This issue affects EU Cookie Compliance GDPR Compliance: from 0.0.0 before 1.26.0...
CVE-2025-48915 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...
CVE-2025-48915 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...
CVE-2025-48915
The CVE-2025-48915 entry describes an Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in the Drupal COOKiES Consent Management module. Affected versions are 0.0.0 through 1.2.14, with remediation provided by upgrading to 1.2.15 or later. The issue stems from inadeq...
CVE-2025-48915 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...
CVE-2025-48914 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...