17308 matches found
Smartling Connector - Less critical - Multiple vulnerabilities - SA-CONTRIB-2024-053
Smartling module allows you to translate content in Drupal 7 using the Smartling Translation Management Platform. The module includes an outdated version of the Guzzle package guzzlehttp/guzzle 6.3.3, which has known security vulnerabilities...
Drupal Improper Error Handling Vulnerability (SA-CORE-2024-002) - Linux
Drupal is prone to an improper error handling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...
Drupal Improper Error Handling Vulnerability (SA-CORE-2024-002) - Windows
Drupal is prone to an improper error handling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...
Drupal 10.2.x < 10.2.10 Improper Error Handling
According to its self-reported version, the instance of Drupal running on the remote web server is 10.2.x prior to 10.2.10. Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system...
Drupal 10.2.x < 10.2.10 Drupal Vulnerability (SA-CORE-2024-002)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.2.x prior to 10.2.10. It is, therefore, affected by a vulnerability. - A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...
DRUPAL-CORE-2024-002
Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...
PT-2024-9995 · Drupal +1 · Drupal Core +1
Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9 Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of...
Drupal core 10.0-10.2.9 - Unauthenticated Multiple Vulnerabilities
Unauthenticated Multiple Vulnerabilities discovered by ? in WordPress Core Drupal versions 10.0-10.2.9...
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...
DRUPAL-CONTRIB-2024-049
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...
DRUPAL-CONTRIB-2024-048
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not sufficiently protect some routes against a Cross Site Request Forgery attack. This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the...
DRUPAL-CONTRIB-2024-047
This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filter for malicious script leading to a reflected cross site scripting XSS vulnerability. The vulnerability exists in the Facets Summary submodule. If you do not use that sub module...
DRUPAL-CONTRIB-2024-046
This module enables you to manage blocks from specific modules in the specific themes. The module doesn't sufficiently check permissions under the scenario when a block is added using the form "/admin/structure/block/add/plugin\id/theme" route "block.admin\add". The attacker can add the block to...
DRUPAL-CONTRIB-2024-045
This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant...
Drupal Facets module < 2.0.9 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Andrea Racco in WordPress Module Facets versions 2.0.9...
Drupal Block permissions module 1.0.0-1.1.9 - Administrator+ Broken Access Control vulnerability
Administrator+ Broken Access Control vulnerability discovered by Francesco Sardara in WordPress Module Block permissions versions 1.0.0-1.1.9...
PT-2025-2096
Name of the Vulnerable Software and Affected Versions Monster Menus versions 0.0.0 through 9.3.1 Description The issue is related to insufficient authorization mechanisms in the Monster Menus module of the Drupal CMS, allowing a remote attacker to disclose protected information and impact the...
PT-2025-2097 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...
PT-2025-2100
Name of the Vulnerable Software and Affected Versions wkhtmltopdf versions . Description The issue affects wkhtmltopdf, a component used in Drupal. No specific details about the nature of the issue or its potential impact are provided. Recommendations At the moment, there is no information about ...