The vulnerability of the Content Entity Clone module in the Drupal CMS system, related to improper authentication, allows attackers to disclose protected information and execute a Forceful Browsing attack.

The vulnerability of the Content Entity Clone module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to disclose protected information and execute a Forceful Browsing attack...

The vulnerability of the Freelinking module in Drupal CMS systems, related to improper authentication, allows attackers to expose protected information and execute a Forceful Browsing attack.

The vulnerability of the Freelinking module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to disclose protected information and execute a Forceful Browsing attack...

Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Containerized Identity Manager

Summary Multiple security vulnerabilities have been addressed in the update to IBM Security Verify Governance - Containerized Identity Manager component. Vulnerability Details CVEID:CVE-2019-11358 DESCRIPTION: jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improp...

The vulnerability of the POST module of the Drupal CMS system allows a hacker to perform a CSRF attack.

The vulnerability of the POST module in the Drupal CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

The vulnerability of the Basic HTTP Authentication module in Drupal CMS systems allows attackers to circumvent existing security restrictions.

The vulnerability of the Basic HTTP Authentication module in Drupal CMS systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

The vulnerability of the POST module in the Drupal CMS system allows attackers to perform cross-site scripting attacks.

The vulnerability of the POST module of the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the Tarte au Citron module in the Drupal CMS system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Tarte au Citron module in the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Active Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

The vulnerability of the Node export module in the Drupal CMS system allows a hacker to execute arbitrary code.

The vulnerability of the Node export module in the Drupal CMS system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Linux - Version Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Full Path Disclosures

Drupal versions prior to 10.2.9, 10.3.x 10.3.6 and 11.0.x 11.0.5 are affected by Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. No source data...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Windows - Version Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Security Bulletin: Vulnerabilities in jQuery affect watsonx.data

Summary jQuery is vulnerable to cross site scripting attacks and to untrusted code execution attacks. These could affect watsonx.data. Vulnerability Details CVEID:CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remot...

DRUPAL-CONTRIB-2025-012

This module enables you to integrate the site with the Google Tag Manager GTM application. The module doesn't sufficiently validate the enabling or disabling of a tag container. The routes involved are not protected against Cross Site Request Forgery CSRF. This vulnerability is mitigated by the...

DRUPAL-CONTRIB-2025-011

This module enables you to integrate the site with the Google Tag Manager GTM application. The module doesn't have the "restrict access" flag on the "administer google\tag\container" permission. A user with this permission can load a GTM container that completely changes the page or inserts...

DRUPAL-CONTRIB-2025-010

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2025-009

This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devices including phones. The module does not properly protect its custom paths, allowing one user to access a different user's two factor configuration...

DRUPAL-CONTRIB-2025-008

This module enables you to add the Matomo web statistics tracking system to your website. The Matomo Analytics Tag Manager sub-module allows you to add one or more Matomo tag containers on your website. The module does not protect against Cross Site Request Forgeries on routes to enable or disabl...

Drupal Google Tag module < 1.8.0,2.0.0-2.0.7 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff in WordPress Module Google Tag versions 1.8.0,2.0.0-2.0.7...

Drupal Google Tag module < 1.8.0,2.0.0-2.0.7 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff in WordPress Module Google Tag versions 1.8.0,2.0.0-2.0.7...