CVE-2024-13258 Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13...

CVE-2024-13257 Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3...

CVE-2024-13257 Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3...

CVE-2024-13257 Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3...

CVE-2024-13256 Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4...

CVE-2024-13256

The Email Contact module for the Drupal CMS is vulnerable to an Insufficient Granularity of Access Control vulnerability (CWE-1220) affecting versions 0.0.0 through 2.0.4 . The root cause is that the module fails to sufficiently handle restricted entity or field access to the mail sending form wh...

CVE-2024-13256 Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4...

CVE-2024-13256 Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4...

CVE-2024-13255

The Drupal RESTful Web Services module (versions 7.X-2.0 through 7.X-2.10 ) is vulnerable to an Exposure of Sensitive Information Through Data Queries (CWE-202) caused by errors in request processing. This flaw allows a remote attacker to perform forceful browsing to gain unauthorized access to p...

CVE-2024-13255 RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10...

CVE-2024-13254

The Drupal REST Views module (versions 0.0.0 through 3.0.1 ) is vulnerable to an Insertion of Sensitive Information Into Sent Data issue (CWE-201). The root cause is insufficient protection of operational data , which allows for forceful browsing . This vulnerability enables a remote attacker to ...

CVE-2024-13254 REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1...

CVE-2024-13254 REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1...

CVE-2024-13254 REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1...

CVE-2024-13253 Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0...

CVE-2024-13253

The Drupal Advanced PWA inc Push Notifications module (versions prior to 1.5.0 ) is vulnerable to an incorrect authorization issue. This flaw allows an unauthorized malicious actor to bypass security restrictions to perform a Forceful Browsing attack. Specifically, the module fails to sufficientl...

CVE-2024-13253 Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0...

CVE-2024-13243

The Drupal Entity Delete Log module (versions 0.0.0 through 1.1.1 ) is vulnerable to a Missing Authorization flaw. Due to insufficient permission checks on the log report page, a remote attacker can perform a Forceful Browsing attack to bypass security restrictions and view information regarding ...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...