17323 matches found
CVE-2020-13672
CVE-2020-13672 is a Drupal core Cross-site Scripting (XSS) issue in the sanitization API. The exposure affects Drupal Core versions: 9.1.x before 9.1.7; 9.0.x before 9.0.12; 8.9.x before 8.9.14; and 7.x before 7.80. The root cause is insufficient filtering of certain scripts during sanitization, ...
CVE-2020-13672
Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...
CVE-2020-13672
Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...
CVE-2020-13669
CVE-2020-13669 is a Drupal Core XSS in the CKEditor image caption handling. Affected versions: Drupal Core 8.8.x before 8.8.10; 8.9.x before 8.9.6; 9.0.x before 9.0.6. Root cause: improper validation/escaping in CKEditor integration leads to injection of script when rendering user-supplied input....
CVE-2020-13669
Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...
CVE-2020-13669
Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...
CVE-2020-13668 Access bypass in Drupal Core 8/9
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...
CVE-2020-13668
CVE-2020-13668 refers to an access-bypass in Drupal Core. Affected are Drupal Core 8.8.x before 8.8.10; 8.9.x before 8.9.6; and 9.0.x before 9.0.6, where HTML rendering in affected forms can be exploited. The vulnerability is addressed by Drupal core patches: upgrade to 8.8.10, 8.9.6, or 9.0.6 (a...
CVE-2020-13668
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...
CVE-2020-13677: Improper Access Control
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected...
CVE-2020-13672: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...
Drupal跨站脚本漏洞
Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal, which stems from the product's Drupal cores sanitization API not effectively filtering certain cross-site scripts. The vulnerability...
PT-2022-8504 · Drupal · Drupal Core Json:Api Module
Name of the Vulnerable Software and Affected Versions: Drupal core JSON:API module affected versions not specified Description: The issue arises when the Drupal core JSON:API module fails to properly restrict access to certain content under specific circumstances, potentially leading to unintende...
CVE-2020-13670: Exposure of Resource to Wrong Sphere
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prio...
PT-2022-8503 · Drupal · Drupal Quickedit Module
Name of the Vulnerable Software and Affected Versions: Drupal QuickEdit module affected versions not specified Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the...
PT-2022-8502 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue concerns the JSON:API and REST/File modules in Drupal, which allow file uploads through their HTTP APIs. However, these modules do not correctly run all file validation, leading to...
CVE-2020-13675: Improper Access Control
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the si...
CVE-2020-13668: Improper Neutralization of Input During Web Page Generation
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...
CVE-2020-13669: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...
