PT-2024-40266 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to an access bypass in Drupal's content moderation system. Under certain conditions, it fails to properly check a user's access to use specific transitions...

Drupal-Wiki 8.31 / 8.30 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 secuvera-SA-2024-02: Multiple Persistent Cross-Site Scritping XSS flaws in Drupal-Wiki Affected Products Drupal Wiki 8.31 Drupal Wiki 8.30 older releases have not been tested References https://www.secuvera.de/advisories/secuvera-SA-2024-02.txt used...

DRUPAL-CONTRIB-2024-018

The Rest views module lets site admins create rest exports in views with additional options for serializing data. This module does not accurately check access and may expose paths to unpublished content. This vulnerability is mitigated by the fact that there must be a specific content structure t...

Drupal Advanced PWA inc Push Notifications module < 1.5.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Andre Groendijk in WordPress Module Advanced PWA inc Push Notifications versions 1.5.0...

Drupal REST Views module < 3.0.1 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by nicxvan in WordPress Module REST Views versions 3.0.1...

PT-2024-10129 · Drupal · Drupal Rest Views

Name of the Vulnerable Software and Affected Versions: Drupal REST Views versions 0.0.0 through 3.0.1 Description: The issue is related to the insertion of sensitive information into sent data, allowing forceful browsing. This can enable a remote attacker to gain unauthorized access to protected...

GHSA-297X-J9PM-XJGG Drupal Core Remote Code Execution Vulnerability

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

Drupal Core Remote Code Execution Vulnerability

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

CVE-2024-31247

Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3...

CVE-2024-31247

CVE-2024-31247 affects FG Drupal to WordPress plugin for WordPress; vulnerability is an information exposure via log files caused by insertion of sensitive data. Affected versions: from n/a through 3.70.3. Patch status from connected data indicates the issue is patched; remediation is to upgrade ...

CVE-2024-31247 WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3...

CVE-2024-31247 WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3...

WordPress Plugin FG Drupal to WordPress 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin FG Drupal to WordPress A l...

PT-2024-23889 · Unknown · Fg Drupal To Wordpress

Name of the Vulnerable Software and Affected Versions: FG Drupal to WordPress versions 3.70.3 and earlier Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For FG Drupal to WordPress versions...

WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerability

Sensitive Data Exposure via Log File vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin FG Drupal to WordPress versions = 3.70.3...

WordPress FG Drupal to WordPress Plugin <= 3.70.3 is vulnerable to Sensitive Data Exposure

Software FG Drupal to WordPress Type Plugin Vulnerable versions = 3.70.3 Fixed in 3.71.0 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31247 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3795aae4239d Credits...

DRUPAL-CONTRIB-2024-016

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting XSS vulnerability. More details are available in CVE-2023-3620. This vulnerability is...

TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting XSS vulnerability. More details are available in CVE-2023-3620. This vulnerability is...

DRUPAL-CONTRIB-2024-015

The Registration role module lets an administrator select a role or multiple roles to automatically assign to new users. The selected role or roles will be assigned to new registrants. The module has a logic error when handling sites that upgraded code and did not run the Drupal update process e....

BIT-DRUPAL-2020-13662

Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions...