CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization...

CVE-2024-55636

Drupal Core is vulnerable to a PHP Object Injection vulnerability due to the deserialization of untrusted data (CWE-502, CWE-915). This issue exists because the core contains a gadget chain of methods that can be exploited if a separate vulnerability allows an attacker to pass unsafe input to the...

CVE-2024-55636

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization...

CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization...

CVE-2024-55635 Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 7.0 before 7.102...

CVE-2024-55635

The Drupal Core CMS is vulnerable to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw affects Drupal Core versions 7.0 through before 7.102 . Exploitation of this vulnerability allows a malicious actor to perform XSS attacks ...

CVE-2024-55635 Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 7.0 before 7.102...

CVE-2024-55635 Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 7.0 before 7.102...

CVE-2024-55635

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 7.0 before 7.102...

CVE-2024-55634 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-55634 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-55634 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-55634

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-55634

A vulnerability in Drupal Core allows for Privilege Escalation due to deficiencies in authentication procedures and improper validation of user roles and permissions. This allows unauthorized users to bypass access restrictions, enhance their privileges remotely, and potentially manipulate applic...

CVE-2024-12393

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-12393 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-12393 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-12393 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Core allows Cross-Site Scripting XSS.This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-12393

Drupal Core is vulnerable to a Cross-Site Scripting (XSS) flaw caused by the improper neutralization of input during web page generation. Specifically, the software uses JavaScript to render status messages in certain configurations without adequate sanitization. This vulnerability affects Drupal...

Infinite loop

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Infinite loop via the Comment module. An attacker can trigger excessive resource consumption by making repeated comment reply...