701 matches found
PT-2024-10484 · Drupal · Drupal Basic Http Authentication
Name of the Vulnerable Software and Affected Versions: Drupal Basic HTTP Authentication versions 7.X-1.0 through 7.X-1.3 Drupal Basic HTTP Authentication versions prior to 7.X-1.4 Description: The issue is related to insufficient authorization mechanisms in the Basic HTTP Authentication module of...
PT-2025-2105 · Drupal · Ohdear Integration
Name of the Vulnerable Software and Affected Versions: OhDear Integration versions 0.0.0 through 2.0.3 Description: The issue is related to incorrect authorization in the OhDear Integration module for Drupal, allowing forceful browsing. This can enable a remote attacker to access confidential...
PT-2025-2097 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...
PT-2025-2096
Name of the Vulnerable Software and Affected Versions Monster Menus versions 0.0.0 through 9.3.1 Description The issue is related to insufficient authorization mechanisms in the Monster Menus module of the Drupal CMS, allowing a remote attacker to disclose protected information and impact the...
PT-2025-2095 · Drupal · Drupal Persistent Login
Name of the Vulnerable Software and Affected Versions: Drupal Persistent Login versions 0.0.0 through 1.8.0 Drupal Persistent Login versions 2.0. through 2.2.2 Description: The issue is related to insufficient session expiration in the Drupal Persistent Login module, allowing for forceful browsin...
PT-2025-2092 · Drupal · Drupal Cms +1
Name of the Vulnerable Software and Affected Versions: Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0 Description: The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can le...
PT-2024-10287 · Unknown · File Entity
Name of the Vulnerable Software and Affected Versions: File Entity versions 7.X- before 7.X-2.39 Description: The issue allows for the insertion of sensitive information into sent data, enabling forceful browsing. This can lead to the disclosure of protected information. The estimated number of...
PT-2025-2089
Name of the Vulnerable Software and Affected Versions Content Entity Clone versions 0.0.0 through 1.0.4 Description The issue is related to incorrect authorization in the Content Entity Clone module for Drupal, allowing forceful browsing. This can enable a remote attacker to disclose protected...
PT-2025-2088
Name of the Vulnerable Software and Affected Versions Drupal Freelinking versions 0.0.0 through 4.0.0 Description The issue is related to an Incorrect Authorization vulnerability in Drupal Freelinking, which allows Forceful Browsing. This vulnerability can be exploited by a remote attacker to...
PT-2025-2087
Name of the Vulnerable Software and Affected Versions Advanced Varnish versions 0.0.0 through 4.0.10 Description The issue is related to the insertion of sensitive information into sent data, which can allow forceful browsing. This can be exploited by a remote attacker to bypass security...
PT-2024-10348
Name of the Vulnerable Software and Affected Versions Drupal Responsive and off-canvas menu versions 0.0.0 through 4.4.3 Description The issue is related to an Incorrect Authorization vulnerability in the Drupal Responsive and off-canvas menu, which allows for Forceful Browsing. This means that a...
PT-2024-10094 · Drupal · Drupal Rest & Json Api Authentication
Name of the Vulnerable Software and Affected Versions: Drupal REST & JSON API Authentication versions 0.0.0 through 2.0.12 Description: The issue is related to an Incorrect Authorization vulnerability in Drupal REST & JSON API Authentication, allowing Forceful Browsing. This can enable a remote...
PT-2024-10345
Name of the Vulnerable Software and Affected Versions Drupal Image Sizes versions 0.0.0 through 3.0.1 Description The issue is related to the insertion of sensitive information into sent data, which allows for forceful browsing. This can be exploited by a remote attacker to bypass security...
PT-2024-10347 · Drupal · Email Contact
Name of the Vulnerable Software and Affected Versions: Email Contact versions 0.0.0 through 2.0.4 Description: The issue is related to insufficient granularity of access control in the Email Contact module for Drupal, allowing forceful browsing. This can be exploited by a remote attacker to bypas...
PT-2024-10134
Name of the Vulnerable Software and Affected Versions Drupal RESTful Web Services versions 7.X-2.0 through 7.X-2.10 Description The issue is related to errors in processing requests, which can allow a remote attacker to gain unauthorized access to protected information. This problem enables...
PT-2024-10086 · Drupal · Drupal Advanced Pwa Inc Push Notifications
Name of the Vulnerable Software and Affected Versions: Drupal Advanced PWA inc Push Notifications versions 0.0.0 through 1.5.0 Description: The issue is related to an incorrect authorization vulnerability in the Drupal Advanced PWA inc Push Notifications module, which allows for forceful browsing...
PT-2024-10361 · Drupal · Drupal Entity Delete Log
Name of the Vulnerable Software and Affected Versions: Drupal Entity Delete Log versions 0.0.0 through 1.1.1 Description: The issue is related to a lack of authorization in the Drupal Entity Delete Log, which allows for forceful browsing. This can enable a remote attacker to bypass security...
CVE-2023-2187
On Triangle MicroWorks' SCADA Data Gateway version = v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event"...
CVE-2023-2187: Missing Authentication for Critical Function
On Triangle MicroWorks' SCADA Data Gateway version = v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event"...
