GHSA-F84Q-MGJ9-8JFC Drupal Content moderation Access bypass

In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass...

Drupal RESTful Web Services module < 7.x-2.10 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Fran Garcia-Linares in WordPress Module RESTful Web Services versions 7.x-2.10...

PT-2024-40106 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1 Description: The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations. Recommendations: If you a...

PT-2024-40162 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal 8 core affected versions not specified Description: The issue concerns the file save upload function, which does not remove leading and trailing dots from filenames. This could allow users with file upload permissions, especially when...

PT-2024-40464 · Ckeditor +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: Drupal versions affected versions not specified Description: The issue is related to the use of the third-party library CKEditor in Drupal, which has a security improvement that protects against Cross Site Scripting XSS vulnerabilities. If...

PT-2024-40185 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: drupal affected versions not specified Description: The issue is related to an access bypass in drupal content moderation. In certain conditions, it fails to check a user's access to use specific transitions. Recommendations: At the moment,...

PT-2024-40130 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal core affected versions not specified Description: The issue is related to the sanitization of variables for shell arguments in the DefaultMailSystem::mail function when sending email, which could potentially lead to remote code...

PT-2024-40447

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue concerns the path module in Drupal, which allows users with the 'administer paths' permission to create pretty URLs for content. Under certain circumstances, a user can enter a...

PT-2024-40299

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The issue allows malicious users to construct a URL that tricks users into being redirected to a 3rd party website, exposing them to potential social engineering attacks. This is possible...

PT-2024-40473

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue is related to the use of the CKEditor library for WYSIWYG editing in Drupal. Vulnerabilities are possible if Drupal is configured to allow the use of CKEditor, potentially allowing a...

PT-2024-40126

Name of the Vulnerable Software and Affected Versions: Drupal version 7 Description: The issue is caused by insufficient validation of the destination query parameter in the drupal goto function, allowing for an Open Redirect. This could trick users into visiting a specially crafted link that...

PT-2024-40220

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue arises from the use of the third-party library Archive Tar, which has released a security improvement. Multiple vulnerabilities are possible if Drupal is configured to allow .tar,...

PT-2024-40039

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue is related to the use of the third-party library CKEditor in Drupal, which has a security improvement that protects against Cross Site Scripting XSS vulnerabilities. If Drupal is...

PT-2024-40429

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue is related to the use of the CKEditor library for WYSIWYG editing in Drupal. Vulnerabilities are possible if Drupal is configured to allow the use of CKEditor, potentially leading to...

PT-2024-40374

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1 Description The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations. Recommendations If you are...

PT-2024-40266 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to an access bypass in Drupal's content moderation system. Under certain conditions, it fails to properly check a user's access to use specific transitions...

PT-2024-40344

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The issue is related to the sanitization of variables for shell arguments in the DefaultMailSystem::mail function when sending email, which could potentially lead to remote code execution...

PT-2024-40092

Name of the Vulnerable Software and Affected Versions: Drupal 8 core affected versions not specified Description: The issue arises from the file save upload function not removing leading and trailing dots from filenames, which could allow users to upload system files like .htaccess. This might...

PT-2024-40367 · Unknown +1 · Archive Tar +1

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to the latest version that updates Archive Tar to 1.4.9 Description: The issue arises from the use of the third-party library Archive Tar, which has released a security improvement. Multiple vulnerabilities are possible ...

PT-2024-40521

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The issue allows malicious users to construct a URL that tricks users into being redirected to a 3rd party website, exposing them to potential social engineering attacks. This is possible...