15775 matches found
Drupal 10.2.x < 10.2.10 Drupal Vulnerability (SA-CORE-2024-002)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.2.x prior to 10.2.10. It is, therefore, affected by a vulnerability. - A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
DRUPAL-CORE-2024-002
Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...
Drupal core 10.0-10.2.9 - Unauthenticated Multiple Vulnerabilities
Unauthenticated Multiple Vulnerabilities discovered by ? in WordPress Core Drupal versions 10.0-10.2.9...
PT-2024-9995 · Drupal +1 · Drupal Core +1
Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9 Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of...
DRUPAL-CONTRIB-2024-049
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...
DRUPAL-CONTRIB-2024-048
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not sufficiently protect some routes against a Cross Site Request Forgery attack. This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the...
DRUPAL-CONTRIB-2024-047
This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filter for malicious script leading to a reflected cross site scripting XSS vulnerability. The vulnerability exists in the Facets Summary submodule. If you do not use that sub module...
DRUPAL-CONTRIB-2024-046
This module enables you to manage blocks from specific modules in the specific themes. The module doesn't sufficiently check permissions under the scenario when a block is added using the form "/admin/structure/block/add/plugin\id/theme" route "block.admin\add". The attacker can add the block to...
DRUPAL-CONTRIB-2024-045
This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant...
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
Microsoft has released security updates to fix a total of 118 vulnerabilities across its software portfolio, two of which have come under active exploitation in the wild. Of the 118 flaws, three are rated Critical, 113 are rated Important, and two are rated Moderate in severity. The Patch Tuesday...
Drupal Facets module < 2.0.9 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Andrea Racco in WordPress Module Facets versions 2.0.9...
PT-2025-2097 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...
Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047
This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filter for malicious script leading to a reflected cross site scripting XSS vulnerability. The vulnerability exists in the Facets Summary submodule. If you do not use that sub module...
PT-2025-2099 · WordPress · Gutenberg
Name of the Vulnerable Software and Affected Versions: Gutenberg versions 0.0.0 through 2.12.0 Gutenberg versions 3.0.0 through 3.0.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in Drupal Gutenberg, which allows for Cross-Site Request Forgery. This...
Drupal Monster Menus module < 9.3.2 - Unauthenticated Multiple Vulnerabilities
Unauthenticated Multiple Vulnerabilities discovered by Dan Wilga in WordPress Module Monster Menus versions 9.3.2...
Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045
This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant...
Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not sufficiently protect some routes against a Cross Site Request Forgery attack. This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the...
CentOS 7 : pcs (RHSA-2022:7343)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7343 advisory. - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. ...