14270 matches found
CVE-2024-45440
Summary: CVE-2024-45440 affects Drupal 11.x-dev, where core/authorize.php can disclose full file paths when hash_salt is set to file_get_contents of a non-existent file. Affected components: Drupal 11.x-dev, core/authorize.php. Root cause (as stated): hash_salt evaluated via file_get_contents of ...
CVE-2024-45440
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
CVE-2024-45440
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
PT-2024-6543 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal versions 11.x-dev Description: The issue is related to a Full Path Disclosure flaw in the core/authorize.php file of the Drupal CMS system. This flaw allows an attacker to disclose system data without authorization. The vulnerability c...
USN-6981-1 drupal7 vulnerabilities
It was discovered that Drupal incorrectly sanitized uploaded filenames. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2020-13671 It was discovered that Drupal incorrectly sanitized archived filenames. A remote attacker could possibly use this issue to overwrite...
USN-6981-1: Drupal vulnerabilities
It was discovered that Drupal incorrectly sanitized uploaded filenames. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2020-13671 It was discovered that Drupal incorrectly sanitized archived filenames. A remote attacker could possibly use this issue to overwrite...
Ubuntu 16.04 LTS : Drupal vulnerabilities (USN-6981-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6981-1 advisory. It was discovered that Drupal incorrectly sanitized uploaded filenames. A remote attacker could possibly use this issue to execute arbitrary code...
DRUPAL-CONTRIB-2024-030
This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hook\ENTITY\TYPE\access hooks meaning the titles of restricted...
Drupal Opigno TinCan Question Type module < 7.x-1.3 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by Juraj Nemec in WordPress Module Opigno TinCan Question Type versions 7.x-1.3...
Drupal Opigno module < 7.x-1.23 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by Yurii Boichenko in WordPress Module Opigno versions 7.x-1.23...
Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hookENTITYTYPEaccess hooks meaning the titles of restricted nod...
Drupal Responsive and off-canvas menu module < 4.4.4 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by collinhaines in WordPress Module Responsive and off-canvas menu versions 4.4.4...
PT-2024-10348 · Drupal · Drupal Responsive/Off-Canvas Menu
Name of the Vulnerable Software and Affected Versions: Drupal Responsive and off-canvas menu versions 0.0.0 through 4.4.3 Description: The issue is related to an Incorrect Authorization vulnerability in the Drupal Responsive and off-canvas menu, which allows for Forceful Browsing. This means that...
Drupal Opigno group manager module < 3.1.1 - Administrator+ Remote Code Execution (RCE) vulnerability
Administrator+ Remote Code Execution RCE vulnerability discovered by catch in WordPress Module Opigno group manager versions 3.1.1...
Drupal Opigno module module < 3.1.2 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by Marcin Grabias in WordPress Module Opigno module versions 3.1.2...
DRUPAL-CONTRIB-2024-026
The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access ...
Drupal View Password module < 6.0.4 - Administrator+ Cross Site Scripting (XSS) vulnerability
Administrator+ Cross Site Scripting XSS vulnerability discovered by Ide Braakman in WordPress Module View Password versions 6.0.4...
CVE-2024-34481
drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page...
