PT-2024-40130 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal core affected versions not specified Description: The issue is related to the sanitization of variables for shell arguments in the DefaultMailSystem::mail function when sending email, which could potentially lead to remote code...

PT-2024-40162 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal 8 core affected versions not specified Description: The issue concerns the file save upload function, which does not remove leading and trailing dots from filenames. This could allow users with file upload permissions, especially when...

PT-2024-40185 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: drupal affected versions not specified Description: The issue is related to an access bypass in drupal content moderation. In certain conditions, it fails to check a user's access to use specific transitions. Recommendations: At the moment,...

RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

This module exposes Drupal resources e.g. entities as RESTful web services. The module doesn't sufficiently restrict access for user resources...

PT-2024-40413 · Packagist · Drupal Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, use: affected versions not specified Description: A visit to the install.php endpoint can cause cached data to become corrupted, potentially impairing a site until caches are rebuilt. Recommendation...

PT-2024-40266 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to an access bypass in Drupal's content moderation system. Under certain conditions, it fails to properly check a user's access to use specific transitions...

Drupal RESTful Web Services module < 7.x-2.10 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Fran Garcia-Linares in WordPress Module RESTful Web Services versions 7.x-2.10...

PT-2024-40158 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue concerns the path module in Drupal, which allows users with the 'administer paths' permission to create pretty URLs for content. Under certain circumstances, a user can enter a...

PT-2024-40367 · Unknown +1 · Archive Tar +1

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to the latest version that updates Archive Tar to 1.4.9 Description: The issue arises from the use of the third-party library Archive Tar, which has released a security improvement. Multiple vulnerabilities are possible ...

RHEL 8 : jquery (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 - jQue...

Drupal-Wiki 8.31 / 8.30 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 secuvera-SA-2024-02: Multiple Persistent Cross-Site Scritping XSS flaws in Drupal-Wiki Affected Products Drupal Wiki 8.31 Drupal Wiki 8.30 older releases have not been tested References https://www.secuvera.de/advisories/secuvera-SA-2024-02.txt used...

PT-2024-25933 · Drupal · Drupal Wiki

Name of the Vulnerable Software and Affected Versions: Drupal Wiki versions prior to 8.31.1 Description: The issue allows for XSS attacks via comments, captions, and image titles of a Wiki page. Recommendations: For versions prior to 8.31.1, update to version 8.31.1 or later to resolve the issue...

DRUPAL-CONTRIB-2024-018

The Rest views module lets site admins create rest exports in views with additional options for serializing data. This module does not accurately check access and may expose paths to unpublished content. This vulnerability is mitigated by the fact that there must be a specific content structure t...

DRUPAL-CONTRIB-2024-017

Progressive web applications are web applications that load like regular web pages or websites but can offer the user functionality such as working offline, push notifications, and device hardware access traditionally available only to native applications. This module doesn't sufficiently protect...

PT-2024-10086 · Drupal · Drupal Advanced Pwa Inc Push Notifications

Name of the Vulnerable Software and Affected Versions: Drupal Advanced PWA inc Push Notifications versions 0.0.0 through 1.5.0 Description: The issue is related to an incorrect authorization vulnerability in the Drupal Advanced PWA inc Push Notifications module, which allows for forceful browsing...

Advanced PWA inc Push Notifications - Critical - Access bypass - SA-CONTRIB-2024-017

Progressive web applications are web applications that load like regular web pages or websites but can offer the user functionality such as working offline, push notifications, and device hardware access traditionally available only to native applications. This module doesn't sufficiently protect...

REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

The Rest views module lets site admins create rest exports in views with additional options for serializing data. This module does not accurately check access and may expose paths to unpublished content. This vulnerability is mitigated by the fact that there must be a specific content structure t...

Drupal Advanced PWA inc Push Notifications module < 1.5.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Andre Groendijk in WordPress Module Advanced PWA inc Push Notifications versions 1.5.0...

Drupal REST Views module < 3.0.1 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by nicxvan in WordPress Module REST Views versions 3.0.1...

PT-2024-10129 · Drupal · Drupal Rest Views

Name of the Vulnerable Software and Affected Versions: Drupal REST Views versions 0.0.0 through 3.0.1 Description: The issue is related to the insertion of sensitive information into sent data, allowing forceful browsing. This can enable a remote attacker to gain unauthorized access to protected...