CVE-2024-13249

CVE-2024-13249 affects Drupal’s Node Access Rebuild Progressive module (versions 7.X-1.0 through 7.X-1.2). The root cause is an improper ownership management vulnerability that enables target influence via framing, effectively an access-bypass risk. Documents label this as a less critical issue (...

CVE-2024-13248 Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0...

CVE-2024-13248 Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0...

CVE-2024-13248

CVE-2024-13248 is a privilege-assignment flaw in Drupal Private content (SA-CONTRIB-2024-012). The vulnerability arises from incorrect permission handling when private content is framed, enabling target influence and an access bypass for content in versions before 2.1.0. Affected product: Drupal ...

CVE-2024-13247

CVE-2024-13247 concerns the Drupal Coffee module (versions 0.0.0 through 1.3.x; prior to 1.4.0). The root cause is improper neutralization/escaping of user input during web page generation, leading to Cross-Site Scripting (XSS) when Coffee renders certain content. The public documentation consist...

CVE-2024-13247 Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2024-13247 Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2...

CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2...

CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2...

CVE-2024-13246

CVE-2024-13246 concerns Drupal’s Node Access Rebuild Progressive module. The vulnerability stems from improper ownership management in the module, which can allow a remote attacker to bypass access controls and influence the target via framing. Affected versions are 0.0.0 through 2.0.1 (up to but...

CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting XSS.This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1...

CVE-2024-13244 Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

Cross-Site Request Forgery CSRF vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3...

CVE-2024-13244

CVE-2024-13244 concerns Drupal Migrate Tools, a Drupal module for migrations. Multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in Migrate Tools, affecting versions 0.0.0 through 6.0.2 (vulnerability before 6.0.3). The underlying issue allows an authenticated administrato...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243

CVE-2024-13243: In Drupal, the Entity Delete Log module (versions 0.0.0 through 1.1.1) suffers a missing authorization vulnerability that enables forceful browsing and an access bypass to log information. The issue is rooted in insufficient permissions handling for the log view/report page, enabl...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13242 Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer:...

CVE-2024-13241 Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5...