CVE-2024-13279: Session Fixation

Session Fixation vulnerability in Drupal Two-factor Authentication TFA allows Session Fixation.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.8.0...

CVE-2024-13239: Weak Authentication

Weak Authentication vulnerability in Drupal Two-factor Authentication TFA allows Authentication Abuse.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.5.0...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Two-factor Authentication prior to version 1.5.0, which stems from the inclusion of a weak authentication vulnerability...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Paragraphs table version 1.23.0 prior to version 2.0.0 through 2.0.2, which stems from insufficient granularity of access control vulnerabilities...

CVE-2024-13272: Insufficient Granularity of Access Control

Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Allow All File Extensions for file fields, which stems from the presence of an issue...

CVE-2024-13280: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0. before 2.2.2...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Persistent Login prior to version 1.8.0, versions 2.0. through 2.2.2, which stems from the inclusion of a session expiration insufficiency issue...

CVE-2024-13301: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client allows Cross-Site Scripting XSS.This issue affects OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client: from 3.0.0...

Drupal 安全漏洞

Drupal is an open source content management system developed in the Drupal community using the PHP language. A security vulnerability exists in Drupal OAuth & OpenID Connect Single Sign On - SSO OAuth/OIDC Client versions 3.0.0 through 3.44.0, and 4.0.0 through 4.0.19, which stems from improperly...

CVE-2024-13250: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Symfony Mailer Lite prior to version 1.0.6, which stems from the inclusion of a cross-site request forgery vulnerability...

CVE-2024-13269: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11...

DRUPAL-CONTRIB-2025-002

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2025-001

This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site. The module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the...

Drupal Email TFA module < 2.0.3 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Ursin Cola in WordPress Module Email TFA versions 2.0.3...

Drupal Profile Private module * - Unauthenticated Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type vulnerability discovered by Dezső Biczó in WordPress Module Profile Private versions...

Privilege Escalation

Drupal Core is vulnerable to Privilege Escalation. The vulnerability is due to improper validation of user roles and permissions, which allows unauthorized users to bypass access restrictions and gain elevated privileges...

Cross-Site Scripting (XSS)

Drupal Core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be executed on the client-side...

Deserialization Of Untrusted Data

Drupal Core is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to insecure deserialization of untrusted data, allows an attacker to inject malicious objects, which can be exploited through the gadget chain to achieve remote code execution...