Unspecified vulnerability in calipso

Calipso is a simple NodeJS content management system. Built on themes similar to Drupal and Wordpress, it is designed to be fast, flexible and simple. calipso has a security vulnerability that can be exploited by an attacker to overwrite files on any file system...

PT-2021-4279

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions 4.14.0 through 4.16.x Description A cross-site scripting XSS vulnerability in the HTML Data Processor allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled. This...

calipso 所有 路径遍历漏洞

Calipso is a simple NodeJS content management system. Built on themes similar to Drupal and Wordpress, it is designed to be fast, flexible and simple. calipso has a security vulnerability that can be exploited by an attacker to overwrite files on any file system...

FreeBSD : drupal7 -- fix possible CSS (f70ab05e-be06-11eb-b983-000c294bb613)

Drupal Security team reports : Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend...

Drupal 9.1.x < 9.1.9 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.0.x prior to 9.0.14 or 9.1.x prior to 9.1.9. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. Drupal uses the third-party library CKEditor which is...

Drupal 9.0.x < 9.0.14 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.0.x prior to 9.0.14 or 9.1.x prior to 9.1.9. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. Drupal uses the third-party library CKEditor which is...

Drupal 8.9.x < 8.9.16 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.16, 9.0.x prior to 9.0.14 or 9.1.x prior to 9.1.9. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. Drupal uses the third-party library CKEditor which is...

DRUPAL-CONTRIB-2021-014

This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity provider to login to your Drupal site. The module doesn't sufficiently protect against unauthorized local access, by way of using the 'password reset' facility, for users who are supposed to only be able to lo...

DRUPAL-CONTRIB-2021-013

This module lets you craft and expose a GraphQL web service API. The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability. This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data...

DRUPAL-CONTRIB-2021-011

Open Social is a Drupal distribution for online communities. The included social\magic\login module doesn't sufficiently validate magic login URLs for user accounts. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerabilit...

DRUPAL-CONTRIB-2021-010

This Open Social distribution provides a turn-key system for building customized social networks. The module doesn't sufficiently process data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access mentions"...

GraphQL - Moderately critical - Information Disclosure - SA-CONTRIB-2021-013

This module lets you craft and expose a GraphQL web service API. The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability. This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data...

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2021-014

This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity provider to login to your Drupal site. The module doesn't sufficiently protect against unauthorized local access, by way of using the 'password reset' facility, for users who are supposed to only be able to lo...

Open Social - Critical - Authentication Bypass - SA-CONTRIB-2021-011

Open Social is a Drupal distribution for online communities. The included socialmagiclogin module doesn't sufficiently validate magic login URLs for user accounts. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerability ...

Open Social - Moderately critical - SQL Injection - SA-CONTRIB-2021-010

This Open Social distribution provides a turn-key system for building customized social networks. The module doesn't sufficiently process data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access mentions"...

Frequently Asked Questions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-012

The Frequently Asked Questions faq module allows users, with appropriate permissions, to create question and answer pairs which they want displayed on the 'faq' page. The 'faq' page is automatically generated from the FAQ nodes configured. Basic Views layouts are also provided and can be customis...

CMSmap

This is an open-source Python tool called CMSmap, designed to automate the process of detecting security flaws in popular Content Management Systems CMSs such as WordPress, Joomla, Drupal, and Moodle. The tool is still in its early stages and may contain bugs or flaws. The primary purpose of CMSm...

Drupal Core Hex Rendering Remote Code Execution

A code execution vulnerability exists in Drupal Core. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Drupal < 8.9.16, 9.0.x < 9.0.14, 9.1.x < 9.1.9 XSS Vulnerability (SA-CORE-2021-003) - Windows

Drupal is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal. The vulnerability is located in CKEditor and can be exploited by a malicious person abused to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application visited...