DRUPAL-CONTRIB-2025-017

This module enables you to create super sets of configuration and enable them conditionally, for example have some modules installed only in some environments. The module does not use Cross Site Request Forgery CSRF tokens to protect routes for enabling or disabling a split. This vulnerability is...

DRUPAL-CONTRIB-2025-016

This module enables your site to obfuscate Email addresses and prevent spambots to collect them. The module doesn't sanitize HTML data attributes when an email address link is transformed to separate span HTML elements and then transformed back by JavaScript leading to a Cross Site Scripting XSS...

DRUPAL-CONTRIB-2025-015

Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events. Invites for a specific user can be seen under certain conditions. The issue is mitigated for events by the fact that social\event\max\enroll has to be enabled...

DRUPAL-CONTRIB-2025-014

Open Social is a Drupal distribution for online communities, which ships with a default optional module social\language to make your platform multilingual. Some site administration configuration does not correctly check access when trying to translate allowing unauthorised people to translate the...

Microsoft's Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation

Microsoft on Tuesday released fixes for 63 security flaws impacting its software products, including two vulnerabilities that it said has come under active exploitation in the wild. Of the 63 vulnerabilities, three are rated Critical, 57 are rated Important, one is rated Moderate, and two are rat...

PT-2025-13850

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9 Description The issue is related to a Missing Authorization vulnerability in Drupal Open Social, which allows Forceful Browsing. Recommendations For Open...

Drupal Configuration Split module < 1.10.0,2.0.0-2.0.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Eric Smith ericgsmith in WordPress Module Configuration Split versions 1.10.0,2.0.0-2.0.1...

SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

This module enables your site to obfuscate Email addresses and prevent spambots to collect them. The module doesn't sanitize HTML data attributes when an email address link is transformed to separate span HTML elements and then transformed back by JavaScript leading to a Cross Site Scripting XSS...

Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events. Invites for a specific user can be seen under certain conditions. The issue is mitigated for events by the fact that socialeventmaxenroll has to be enabled...

Drupal Open Social module < 12.3.11,12.4.0-12.4.9 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Robert Ragas robertragas in WordPress Module Open Social versions 12.3.11,12.4.0-12.4.9...

Drupal Open Social module < 12.3.11,12.4.0-12.4.9 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Robert Ragas robertragas in WordPress Module Open Social versions 12.3.11,12.4.0-12.4.9...

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Open Social is a Drupal distribution for online communities, which ships with a default optional module sociallanguage to make your platform multilingual. Some site administration configuration does not correctly check access when trying to translate allowing unauthorised people to translate thes...

Drupal SpamSpan filter module < 3.2.1 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module SpamSpan filter versions 3.2.1...

Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

This module enables you to create super sets of configuration and enable them conditionally, for example have some modules installed only in some environments. The module does not use Cross Site Request Forgery CSRF tokens to protect routes for enabling or disabling a split. This vulnerability is...

Security Bulletin: Vulnerabilities in the jquery-1.10.0.js package affect Data Replication on Cloud Pak for Data

Summary Multiple vulnerabilities in the jquery-1.10.0.js package used in Data Replication on Cloud Pak for Data were addressed. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing option elements from...

GHSA-76P7-773F-R4Q5 vulnerabilities

Vulnerabilities for packages: arangodb, opensearch-dashboards, drupal, opensearch-dashboards-fips...

CVE-2024-11831 vulnerabilities

Vulnerabilities for packages: arangodb, opensearch-dashboards, drupal, opensearch-dashboards-fips...

The vulnerability of the TFA two-factor authentication module in Drupal CMS systems allows a hacker to intercept the user’s session.

The vulnerability of the Two-factor Authentication TFA module in Drupal CMS systems is related to improper session management. Exploiting this vulnerability could allow a malicious actor to intercept a user’s session...

The vulnerability of the Smart IP Ban module in the Drupal CMS system allows a violator to view and modify settings.

The vulnerability of the Smart IP Ban module in the Drupal CMS system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely view and modify settings...

The vulnerability of the Open Social CMS system’s Drupal module, related to insufficient control over the frequency of interactions, allows attackers to trigger a service failure.

The vulnerability of the Open Social CMS system, Drupal, is related to insufficient control over the frequency of interactions. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...