PT-2024-40521

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The issue allows malicious users to construct a URL that tricks users into being redirected to a 3rd party website, exposing them to potential social engineering attacks. This is possible...

PT-2024-40126

Name of the Vulnerable Software and Affected Versions: Drupal version 7 Description: The issue is caused by insufficient validation of the destination query parameter in the drupal goto function, allowing for an Open Redirect. This could trick users into visiting a specially crafted link that...

PT-2024-40429

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue is related to the use of the CKEditor library for WYSIWYG editing in Drupal. Vulnerabilities are possible if Drupal is configured to allow the use of CKEditor, potentially leading to...

PT-2024-40220

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue arises from the use of the third-party library Archive Tar, which has released a security improvement. Multiple vulnerabilities are possible if Drupal is configured to allow .tar,...

PT-2024-40106 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1 Description: The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations. Recommendations: If you a...

PT-2024-40185 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: drupal affected versions not specified Description: The issue is related to an access bypass in drupal content moderation. In certain conditions, it fails to check a user's access to use specific transitions. Recommendations: At the moment,...

PT-2024-40162 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal 8 core affected versions not specified Description: The issue concerns the file save upload function, which does not remove leading and trailing dots from filenames. This could allow users with file upload permissions, especially when...

Drupal RESTful Web Services module < 7.x-2.10 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Fran Garcia-Linares in WordPress Module RESTful Web Services versions 7.x-2.10...

PT-2024-40374

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1 Description The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations. Recommendations If you are...

PT-2024-40299

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The issue allows malicious users to construct a URL that tricks users into being redirected to a 3rd party website, exposing them to potential social engineering attacks. This is possible...

PT-2024-40447

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The issue concerns the path module in Drupal, which allows users with the 'administer paths' permission to create pretty URLs for content. Under certain circumstances, a user can enter a...

RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

This module exposes Drupal resources e.g. entities as RESTful web services. The module doesn't sufficiently restrict access for user resources...

PT-2024-10134

Name of the Vulnerable Software and Affected Versions Drupal RESTful Web Services versions 7.X-2.0 through 7.X-2.10 Description The issue is related to errors in processing requests, which can allow a remote attacker to gain unauthorized access to protected information. This problem enables...

Drupal-Wiki 8.31 / 8.30 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 secuvera-SA-2024-02: Multiple Persistent Cross-Site Scritping XSS flaws in Drupal-Wiki Affected Products Drupal Wiki 8.31 Drupal Wiki 8.30 older releases have not been tested References https://www.secuvera.de/advisories/secuvera-SA-2024-02.txt used...

DRUPAL-CONTRIB-2024-018

The Rest views module lets site admins create rest exports in views with additional options for serializing data. This module does not accurately check access and may expose paths to unpublished content. This vulnerability is mitigated by the fact that there must be a specific content structure t...

PT-2024-10129 · Drupal · Drupal Rest Views

Name of the Vulnerable Software and Affected Versions: Drupal REST Views versions 0.0.0 through 3.0.1 Description: The issue is related to the insertion of sensitive information into sent data, allowing forceful browsing. This can enable a remote attacker to gain unauthorized access to protected...

Drupal REST Views module < 3.0.1 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by nicxvan in WordPress Module REST Views versions 3.0.1...

Drupal Advanced PWA inc Push Notifications module < 1.5.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Andre Groendijk in WordPress Module Advanced PWA inc Push Notifications versions 1.5.0...

GHSA-297X-J9PM-XJGG Drupal Core Remote Code Execution Vulnerability

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

Drupal Core Remote Code Execution Vulnerability

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...