Drupal 安全漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal version 9.3, which stems from the fact that the Common Entity Access API is not fully integrated with existing permissions, resulting in the possibility of certai...

CVE-2023-31250

Drupal core contains a path traversal vulnerability in the file download facility caused by insufficient sanitization of file paths. This can lead to unauthorized access to private files (high confidentiality impact). Affected: Drupal core; vulnerability tracked as SA-CORE-2023-005 (CVE-2023-3125...

CVE-2023-31250 Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

CVE-2022-25274

CVE-2022-25274 concerns Drupal 9.3 where a generic entity access API for revisions was not fully integrated with existing permissions. The root cause is the incomplete integration between the revisions API and per-item access controls, which can permit access bypass for users who can use revision...

CVE-2022-25274

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual...

Access Bypass

drupal is vulnerable to Access Bypass. The vulnerability exits in processinput parameter of FormBuilder.php because of the API access element not properly evaluate . which allows an attacker to access sensitive information in the system...

GHSA-CFH2-7F6H-3M85 Access bypass in Drupal Core

Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to...

Access bypass in Drupal Core

Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerabilities CVE-2020-28500, CVE-2021-23337, CVE-2020-8203

Summary There are vulnerabilities CVE-2020-28500, CVE-2021-23337, CVE-2020-8203 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remot...

Drupal 7.x < 7.96 Access Bypass Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8 or 10.0.x prior to 10.0.8. The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in...

Drupal 10.0.x < 10.0.8 Access Bypass Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8 or 10.0.x prior to 10.0.8. The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in...

Drupal 9.5.x < 9.5.8 Access Bypass Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8 or 10.0.x prior to 10.0.8. The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in...

Drupal 9.4.x < 9.4.14 Access Bypass Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8 or 10.0.x prior to 10.0.8. The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in...

PT-2023-12784 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The Drupal core form API evaluates form element access incorrectly under certain circumstances. This may lead to a user being able to alter data they should not have access to. No forms...

Drupal Releases Security Advisory to Address Vulnerability in Drupal Core

Drupal has released a security advisory to address an access bypass vulnerability affecting multiple Drupal versions. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Drupal security advisory SA-CORE-2023-005lin...

@boomerang-io/gatsby-theme-boomerang (>=1.5.0-beta.0, <=1.6.2), @sonarsource/gatsby-theme-marketing (>=3.1.0, <=3.5.0) +1 more potentially affected by CVE-2023-30548 via gatsby-plugin-sharp (>=5.0.0, <=5.6.0)

gatsby-plugin-sharp NPM version =5.0.0, =1.5.0-beta.0, =3.1.0, =5.0.0-alpha-drupal-proxyurl.14, =5.0.0-alpha-v5.d20221012t101120.57 Source cves: CVE-2023-30548 Source advisory: OSV:GHSA-H2PM-378C-PCXX...

Drupal 7.x < 7.96 / 9.4.x < 9.4.14 / 9.5.x < 9.5.8 / 10.x < 10.0.8 Drupal Vulnerability (SA-CORE-2023-005)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8, or 10.x prior to 10.0.8. It is, therefore, affected by a vulnerability. - The file download facility doesn't sufficiently sanitize fil...

Security Bulletin: Multiple vulnerabilities found in third party libraries used by IBM® MobileFirst Platform

Summary There are multiple vulnerabilities in open source libraries used by IBM MobileFirst Platform Foundation. They are addressed in this update. Vulnerability Details CVEID:CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied...

DRUPAL-CORE-2023-005

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...