Drupal core unrestricted file upload

Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to...

GHSA-7GWJ-7FHM-VW4W Drupal core unrestricted file upload

Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to...

GHSA-PR99-C33P-FWF6 Drupal core Denial of Service

A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...

Drupal core Denial of Service

A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...

Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links"...

GHSA-7V68-3PR5-H3CR Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links"...

GHSA-6MGP-V5CM-GHG5 Drupal core Remote Code Execution

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail, which could lead to remote code execution...

Drupal core Remote Code Execution

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail, which could lead to remote code execution...

GHSA-GFVF-2F25-F34R Drupal Anonymous Open Redirect

Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users int...

Drupal Anonymous Open Redirect

Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users int...

Drupal External URL injection through URL aliases leading to Open Redirect

The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url...

GHSA-7F4F-P7MQ-P4FV Drupal External URL injection through URL aliases leading to Open Redirect

The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url...

GHSA-F84Q-MGJ9-8JFC Drupal Content moderation Access bypass

In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass...

Drupal Content moderation Access bypass

In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass...

Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days

Microsoft has addressed a total of 61 new security flaws in its software as part of its Patch Tuesday updates for May 2024, including two zero-days which have been actively exploited in the wild. Of the 61 flaws, one is rated Critical, 59 are rated Important, and one is rated Moderate in severity...

PT-2024-40106 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1 Description: The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations. Recommendations: If you a...

PT-2024-40513 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal version 7 Description: The issue is caused by insufficient validation of the destination query parameter in the drupal goto function, allowing for an Open Redirect. This could trick users into visiting a specially crafted link that...

PT-2024-40345 · Unknown · Contextual Links

Name of the Vulnerable Software and Affected Versions: Contextual Links module affected versions not specified Description: The issue arises from insufficient validation of requested contextual links by the Contextual Links module. However, the risk is mitigated because an attacker would need to...

PT-2024-40464 · Ckeditor +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: Drupal versions affected versions not specified Description: The issue is related to the use of the third-party library CKEditor in Drupal, which has a security improvement that protects against Cross Site Scripting XSS vulnerabilities. If...

PT-2024-40492 · Packagist · Drupal/Drupal

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: A visit to the install.php endpoint can cause cached data to become corrupted, potentially impairing a site until caches are rebuilt. Recommendations: At the moment, there is no...