CVE-2020-13674

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed. Removing the...

CVE-2020-13675

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the si...

CVE-2020-13675

CVE-2020-13675 affects Drupal's JSON:API and REST/File modules, where HTTP API file uploads bypass part of the site’s file validation. The vulnerability arises because these modules do not consistently enforce all file validation checks, allowing an attacker to upload files that bypass the intend...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

CVE-2020-13673

CVE-2020-13673 affects the Drupal core Media module, where a filter for embedding media in content fields can let an unprivileged user inject HTML when viewed by a privileged user, enabling cross-site scripting. The issue is documented by NVD as a XSS risk via the media embedding filter. Remediat...

CVE-2020-13672

Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...

CVE-2020-13672

CVE-2020-13672 is a Drupal core Cross-site Scripting (XSS) issue in the sanitization API. The exposure affects Drupal Core versions: 9.1.x before 9.1.7; 9.0.x before 9.0.12; 8.9.x before 8.9.14; and 7.x before 7.80. The root cause is insufficient filtering of certain scripts during sanitization, ...

CVE-2020-13672

Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...

CVE-2020-13669

CVE-2020-13669 is a Drupal Core XSS in the CKEditor image caption handling. Affected versions: Drupal Core 8.8.x before 8.8.10; 8.9.x before 8.9.6; 9.0.x before 9.0.6. Root cause: improper validation/escaping in CKEditor integration leads to injection of script when rendering user-supplied input....

CVE-2020-13669

Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

CVE-2020-13668

CVE-2020-13668 refers to an access-bypass in Drupal Core. Affected are Drupal Core 8.8.x before 8.8.10; 8.9.x before 8.9.6; and 9.0.x before 9.0.6, where HTML rendering in affected forms can be exploited. The vulnerability is addressed by Drupal core patches: upgrade to 8.8.10, 8.9.6, or 9.0.6 (a...

CVE-2020-13668 Access bypass in Drupal Core 8/9

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

PT-2022-8501 · Quickedit · Quickedit

Name of the Vulnerable Software and Affected Versions: QuickEdit module affected versions not specified Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues...

Drupal跨站脚本漏洞

Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal, which stems from the product's Drupal cores sanitization API not effectively filtering certain cross-site scripts. The vulnerability...

PT-2022-8503 · Drupal · Drupal Quickedit Module

Name of the Vulnerable Software and Affected Versions: Drupal QuickEdit module affected versions not specified Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the...

PT-2022-8502 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue concerns the JSON:API and REST/File modules in Drupal, which allow file uploads through their HTTP APIs. However, these modules do not correctly run all file validation, leading to...

PT-2022-8504 · Drupal · Drupal Core Json:Api Module

Name of the Vulnerable Software and Affected Versions: Drupal core JSON:API module affected versions not specified Description: The issue arises when the Drupal core JSON:API module fails to properly restrict access to certain content under specific circumstances, potentially leading to unintende...

PT-2022-7278 · Guzzle +2 · Guzzlehttp/Psr7 +2

Name of the Vulnerable Software and Affected Versions: guzzlehttp/psr7 versions prior to 1.8.4 and 2.1.1 Description: The issue is related to improper header parsing in the guzzlehttp/psr7 library. An attacker could sneak in a new line character and pass untrusted values in both the header names...

Drupal Administration Panel Login Form Bruteforced

The scanner successfully authenticated on the Drupal administration panel by using weak or predictable credentials. No source data...

DRUPAL-CONTRIB-2022-024

The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...