Drupal 跨站脚本漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Entity Embed module, which originates from a WEB application that does not adequately validate that a request is coming from a trusted user. An...

Drupal 8.9.x < 8.9.19 / 9.1.x < 9.1.13 / 9.2.x < 9.2.6 Multiple Vulnerabilities (drupal-2021-09-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.19, 9.1.x prior to 9.1.13, or 9.2.x prior to 9.2.6. It is, therefore, affected by multiple vulnerabilities. - Under some circumstances, the Drupal core JSON:API module does not...

Drupal 访问控制错误漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. An access control error vulnerability exists in Drupal, where a remote user can bypass implemented security restrictions and read certain field data...

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed. Removing the...

Drupal 代码问题漏洞

Drupal is an open source content management system developed by the Drupal community using the PHP language. A code issue exists in Drupal that is caused by improper access restrictions in the program's "JSON:API" module and "REST/File" module. A remote user could bypass the implemented security...

Drupal 8.9.x < 8.9.18 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.18, 9.1.x prior to 9.1.12, or 9.2.x prior to 9.2.4. It is, therefore, affected by multiple vulnerabilities due to its usage of a third party component, CKEditor, for WYSIWYG...

Drupal 9.2.x < 9.2.4 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.18, 9.1.x prior to 9.1.12, or 9.2.x prior to 9.2.4. It is, therefore, affected by multiple vulnerabilities due to its usage of a third party component, CKEditor, for WYSIWYG...

Drupal 9.1.x < 9.1.12 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.18, 9.1.x prior to 9.1.12, or 9.2.x prior to 9.2.4. It is, therefore, affected by multiple vulnerabilities due to its usage of a third party component, CKEditor, for WYSIWYG...

elFinder 输入验证错误漏洞

elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling, and other features. A security vulnerability exists in all versions of elFinder.NetCore in Snyk. The vulnerability is due to a lack of checking of user input and...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal (201714)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details Third Party Entry: 201714 DESCRIPTION: Gutenberg module for Drupal could allow a remote attacker to bypass security restrictions, caused by improper validation of access rules in certain situations. By sendin...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in Drupal CKEditor (CVE-2021-26271, CVE-2021-26272)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2021-26271 DESCRIPTION: CKEditor is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the Advanced Tab for Dialogs plugin. By persuading a victim t...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal CKEditor (CVE-2020-27193)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-27193 DESCRIPTION: CKSource CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Color Button dialog. A remote attacker could exploit thi...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal CKEditor (CVE-2021-33829)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-33829 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious...

DRUPAL-CONTRIB-2021-025

The Admin Toolbar admintoolbar module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work. The Admin Toolbar Search sub-module of this module doesn't sanitize user input in certain cases, which leads to a...

Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025

The Admin Toolbar admintoolbar module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work. The Admin Toolbar Search sub-module of this module doesn't sanitize user input in certain cases, which leads to a...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal (CVE-2021-33829)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-33829 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious...

Security Bulletin: IBM API Connect is impacted by a cross site scripting vulnerability in Drupal core SA-CORE-2021-002

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details Third Party Entry: 200544 DESCRIPTION: Drupal core is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the sanitization API. A remote authenticated attacker could...

Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems

Close to 14 million Linux-based systems are directly exposed to the Internet, making them a lucrative target for an array of real-world attacks that could result in the deployment of malicious web shells, coin miners, ransomware, and other trojans. That's according to an in-depth look at the Linu...

Drupal 8.9.x < 8.9.18, 9.x < 9.1.12, 9.2.x < 9.2.4 Multiple CKEditor Library Vulnerabilities (SA-CORE-2021-005) - Windows

Drupal is prone to a vulnerability in the third-party library CKEditor. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal. A malicious party can exploit the vulnerability to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application is visited. The vulnerability is located in the...