Drupal core Denial of Service

A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...

GHSA-7V68-3PR5-H3CR Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links"...

Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links"...

GHSA-6MGP-V5CM-GHG5 Drupal core Remote Code Execution

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail, which could lead to remote code execution...

Drupal core Remote Code Execution

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail, which could lead to remote code execution...

GHSA-GFVF-2F25-F34R Drupal Anonymous Open Redirect

Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users int...

Drupal Anonymous Open Redirect

Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users int...

GHSA-7F4F-P7MQ-P4FV Drupal External URL injection through URL aliases leading to Open Redirect

The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url...

Drupal External URL injection through URL aliases leading to Open Redirect

The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url...

GHSA-F84Q-MGJ9-8JFC Drupal Content moderation Access bypass

In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass...

Drupal Content moderation Access bypass

In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass...

PT-2024-40513 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal version 7 Description: The issue is caused by insufficient validation of the destination query parameter in the drupal goto function, allowing for an Open Redirect. This could trick users into visiting a specially crafted link that...

PT-2024-40266 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to an access bypass in Drupal's content moderation system. Under certain conditions, it fails to properly check a user's access to use specific transitions...

PT-2024-40092

Name of the Vulnerable Software and Affected Versions: Drupal 8 core affected versions not specified Description: The issue arises from the file save upload function not removing leading and trailing dots from filenames, which could allow users to upload system files like .htaccess. This might...

PT-2024-40039

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue is related to the use of the third-party library CKEditor in Drupal, which has a security improvement that protects against Cross Site Scripting XSS vulnerabilities. If Drupal is...

PT-2024-40473

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue is related to the use of the CKEditor library for WYSIWYG editing in Drupal. Vulnerabilities are possible if Drupal is configured to allow the use of CKEditor, potentially allowing a...

PT-2024-40106 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1 Description: The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations. Recommendations: If you a...

PT-2024-40185 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: drupal affected versions not specified Description: The issue is related to an access bypass in drupal content moderation. In certain conditions, it fails to check a user's access to use specific transitions. Recommendations: At the moment,...

PT-2024-40162 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal 8 core affected versions not specified Description: The issue concerns the file save upload function, which does not remove leading and trailing dots from filenames. This could allow users with file upload permissions, especially when...

Drupal RESTful Web Services module < 7.x-2.10 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Fran Garcia-Linares in WordPress Module RESTful Web Services versions 7.x-2.10...