Drupal Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed Drupal plugins. No source data...

Access Control Bypass

drupal/core is vulnerable to Access Control Bypass. The vulnerability is due to the download facility failing to sufficiently sanitize file paths, resulting in private file exposure to users who shouldn't have access...

Access Control Bypass

drupal/core is vulnerable to Access Control Bypass. The API was not integrated with existing permission controls, resulting in access bypass for users who have access to revisions of content, but not individual items...

Drupal path traversal vulnerability

Drupal is an open source content management system developed by the Drupal community using the PHP language. Drupal path traversal vulnerability , the vulnerability stems from the file download tool can not be sufficiently clean up the file path , an attacker can use this vulnerability leads to...

DRUPAL-CONTRIB-2023-014

S3 File System s3fs provides an additional file system to your Drupal site, which stores files in Amazon's Simple Storage Service S3 or any other S3-compatible storage service. This module may fail to validate that a file being requested to be moved to storage was uploaded during the same web...

Improper Input Validation

drupal/core is vulnerable to Improper Input Validation. The vulnerability exists due to lack of input validations in contributed or custom modules' forms which allows an attacker to inject disallowed values or alter sensitive data...

Cross-site Scripting (XSS)

drupal/core is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to lack of domain validations which allows an attacker to inject and execute arbitrary JavaScript which can result in cookie exfiltration...

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2023-014

S3 File System s3fs provides an additional file system to your Drupal site, which stores files in Amazon's Simple Storage Service S3 or any other S3-compatible storage service. This module may fail to validate that a file being requested to be moved to storage was uploaded during the same web...

CVE-2018-25085

A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsivemenusadminformsubmit of the file responsivemenus.module of the component Configuration Setting Handler. The manipulation leads to cross site...

CVE-2018-25085

A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsivemenusadminformsubmit of the file responsivemenus.module of the component Configuration Setting Handler. The manipulation leads to cross site...

Cross site scripting

A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsivemenusadminformsubmit of the file responsivemenus.module of the component Configuration Setting Handler. The manipulation leads to cross site...

CVE-2018-25085 Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting

A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsivemenusadminformsubmit of the file responsivemenus.module of the component Configuration Setting Handler. The manipulation leads to cross site...

CVE-2018-25085

CVE-2018-25085 affects Drupal’s Responsive Menus module (7.x-1.x-dev), specifically the function responsive_menus_admin_form_submit in the file responsive_menus.module. The vulnerability enables cross-site scripting and can be exploited remotely via the affected component. The issue is addressed ...

Drupal 跨站脚本漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A cross-site scripting vulnerability exists in Drupal, which stems from a cross-site scripting vulnerability in the responsivemenus module...

PT-2023-10825 · Drupal · Responsive Menu

Name of the Vulnerable Software and Affected Versions: Responsive Menus versions 7.x-1.x-dev through 7.x-1.6 Description: A vulnerability was found in the Responsive Menus module on Drupal, affecting the responsive menus admin form submit function of the responsive menus.module file. This issue...

Drupal Access Bypass Vulnerability (SA-CORE-2023-005) - Linux

Drupal is prone to an access bypass vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Access Bypass Vulnerability (SA-CORE-2023-005) - Windows

Drupal is prone to an access bypass vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Access bypass in Drupal core

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

GHSA-8849-CV9F-VCCM Access bypass in Drupal core

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

CVE-2023-31250

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...