Drupal.org - vulnerabilities (CVEs)

9 CVEs in 2 products, 0 in the last 30 days, newest from 2024-01-16.

Products

• Drupal Core - 8 CVEs
• Drupal - 1 CVEs

Newest CVEs of Drupal.org

• CVE-2024-22362 - CVSS 7.5 (high), 2024-01-16: Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a…
• CVE-2017-6920 - CVSS 9.8 (critical), 2018-08-06: Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during…
• CVE-2017-6930 - CVSS 8.1 (high), 2018-03-01: In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as…
• CVE-2017-6926 - CVSS 8.1 (high), 2018-03-01: In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and…
• CVE-2017-6929 - CVSS 6.1 (medium), 2018-03-01: A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it…
• CVE-2017-6932 - CVSS 4.7 (medium), 2018-03-01: Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in…
• CVE-2017-6928 - CVSS 5.3 (medium), 2018-03-01: Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the…
• CVE-2017-6931 - CVSS 6.5 (medium), 2018-03-01: In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the…
• CVE-2017-6927 - CVSS 6.1 (medium), 2018-03-01: Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially…