Missing Authorization

Overview goalgorilla/opensocial is a distribution for building social communities and intranets. Affected versions of this package are vulnerable to Missing Authorization where newly uploaded files were no longer stored in the private file system as intended. An attacker can gain unauthorized...

CVE-2024-13312

CVE-2024-13312 affects the Drupal Open Social distribution. A missing authorization vulnerability allows forceful browsing / unauthorized access to restricted functionality in Open Social versions 11.8.0–12.3.9 and 12.4.0–12.4.8. The cited advisories indicate the issue stems from improper access ...

CVE-2024-13312 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9...

CVE-2024-13312 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9...

CVE-2024-13312 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9...

CVE-2024-13311 Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields:...

CVE-2024-13311

CVE-2024-13311 describes a vulnerability in Drupal related to the Allow All File Extensions for file fields feature. The consolidated records indicate Drupal’s file field extension filtering can be bypassed, enabling potential impact to file handling. The available metrics from the CVE entry show...

CVE-2024-13311 Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields:...

CVE-2024-13310 Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal:...

CVE-2024-13310 Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal:...

CVE-2024-13310

CVE-2024-13310 corresponds to a vulnerability in Drupal Git Utilities for Drupal (Git Utilities module). The connected PT-2024-10078 entry describes the issue as related to insufficient protection of service data in the Git Utilities module for Drupal, enabling a remote attacker to read, modify, ...

CVE-2024-13309 Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1...

CVE-2024-13309 Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1...

CVE-2024-13309 Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1...

CVE-2024-13309

CVE-2024-13309 affects the Drupal Login Disable module (versions 2.0.0–2.1.1). The root cause is improper authentication/incorrect access control, enabling a bypass of login protection intended by the module. The vulnerability could allow an attacker to log in or bypass restrictions for existing ...

CVE-2024-13308 Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Browser Back Button allows Cross-Site Scripting XSS.This issue affects Browser Back Button: from 1.0.0 before 2.0.2...

CVE-2024-13308 Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Browser Back Button allows Cross-Site Scripting XSS.This issue affects Browser Back Button: from 1.0.0 before 2.0.2...

CVE-2024-13308

CVE-2024-13308 affects the Drupal Browser Back Button module. The vulnerability is an improper neutralization of input during web page generation (XSS) in the module’s back-button block, stemming from insufficient escaping of administrator-entered text. Affected versions: 1.0.0–2.0.2. Impact desc...

CVE-2024-13308 Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Browser Back Button allows Cross-Site Scripting XSS.This issue affects Browser Back Button: from 1.0.0 before 2.0.2...

CVE-2024-13305

The CVE-2024-13305 entry concerns the Drupal Entity Form Steps module, with the affected range: 0.0.0 through 1.1.3. The root cause is improper neutralization of input during web page generation, enabling Cross-Site Scripting (XSS). The vulnerability is tied to the Entity Form Steps functionality...