* * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2022-25271	20		2022-02-16	2022-02-25	4.3	None	Remote	Medium	Not required	None	Partial	None
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
2	CVE-2022-25270	863		2022-02-17	2022-02-25	4.0	None	Remote	Low	???	Partial	None	None
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
3	CVE-2022-24775	20		2022-03-21	2022-03-29	5.0	None	Remote	Low	Not required	None	Partial	None
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
4	CVE-2022-24729			2022-03-16	2022-03-28	5.0	None	Remote	Low	Not required	None	None	Partial
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
5	CVE-2022-24728	79	XSS Bypass	2022-03-16	2022-03-28	3.5	None	Remote	Medium	???	None	Partial	None
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
6	CVE-2021-41184	79	Exec Code XSS	2021-10-26	2022-04-20	4.3	None	Remote	Medium	Not required	None	Partial	None
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
7	CVE-2021-41183	79	Exec Code XSS	2021-10-26	2022-04-20	4.3	None	Remote	Medium	Not required	None	Partial	None
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
8	CVE-2021-41182	79	Exec Code XSS	2021-10-26	2022-04-20	4.3	None	Remote	Medium	Not required	None	Partial	None
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
9	CVE-2021-41165	79	XSS Bypass	2021-11-17	2022-04-20	3.5	None	Remote	Medium	???	None	Partial	None
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
10	CVE-2021-41164	79	XSS Bypass	2021-11-17	2022-04-20	3.5	None	Remote	Medium	???	None	Partial	None
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
11	CVE-2021-33829	79	XSS	2021-06-09	2021-11-23	4.3	None	Remote	Medium	Not required	None	Partial	None
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
12	CVE-2020-36193	22	Dir. Trav.	2021-01-18	2022-01-01	5.0	None	Remote	Low	Not required	None	Partial	None
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
13	CVE-2020-28949	74		2020-11-19	2022-01-06	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
14	CVE-2020-28948	502		2020-11-19	2022-03-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
15	CVE-2020-13688	79	XSS	2021-06-11	2021-06-21	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
16	CVE-2020-13677	863	Bypass	2022-02-11	2022-02-18	4.3	None	Remote	Medium	Not required	Partial	None	None
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
17	CVE-2020-13676	863		2022-02-11	2022-02-18	4.0	None	Remote	Low	???	Partial	None	None
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
18	CVE-2020-13675	434	Bypass	2022-02-11	2022-02-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
19	CVE-2020-13674	352	CSRF	2022-02-11	2022-02-18	4.3	None	Remote	Medium	Not required	None	Partial	None
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
20	CVE-2020-13672	79	XSS	2022-02-11	2022-04-12	2.6	None	Remote	High	Not required	None	Partial	None
Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.
21	CVE-2020-13671	434		2020-11-20	2022-01-01	6.5	None	Remote	Low	???	Partial	Partial	Partial
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
22	CVE-2020-13670	668		2022-02-11	2022-02-23	5.0	None	Remote	Low	Not required	Partial	None	None
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
23	CVE-2020-13669	79	XSS	2022-02-11	2022-02-17	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
24	CVE-2020-13668	79	XSS Bypass	2022-02-11	2022-02-23	4.3	None	Remote	Medium	Not required	None	Partial	None
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
25	CVE-2020-13667	276	Bypass	2021-05-17	2021-06-01	4.3	None	Remote	Medium	Not required	Partial	None	None
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
26	CVE-2020-13665	863	Bypass	2021-05-05	2021-05-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.
27	CVE-2020-13664	77	Exec Code	2021-05-05	2021-05-14	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.
28	CVE-2020-13663	352	CSRF	2021-06-11	2021-06-21	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
29	CVE-2020-13662	601		2021-05-05	2021-05-13	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
30	CVE-2020-11023	79	Exec Code XSS	2020-04-29	2022-05-12	4.3	None	Remote	Medium	Not required	None	Partial	None
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
31	CVE-2020-11022	79	Exec Code XSS	2020-04-29	2022-05-12	4.3	None	Remote	Medium	Not required	None	Partial	None
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
32	CVE-2020-9281	79	XSS	2020-03-07	2022-02-21	4.3	None	Remote	Medium	Not required	None	Partial	None
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
33	CVE-2019-11831	22	Dir. Trav. Bypass	2019-05-09	2021-10-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
34	CVE-2019-11358	1321		2019-04-20	2022-04-06	4.3	None	Remote	Medium	Not required	None	Partial	None
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
35	CVE-2019-10911	287		2019-05-16	2021-09-29	6.0	None	Remote	Medium	???	Partial	Partial	Partial
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
36	CVE-2019-10910	89	Exec Code Sql	2019-05-16	2021-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
37	CVE-2019-10909	79	XSS	2019-05-16	2021-04-20	3.5	None	Remote	Medium	???	None	Partial	None
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
38	CVE-2019-6341	79	XSS	2019-03-26	2019-05-16	3.5	None	Remote	Medium	???	None	Partial	None
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
39	CVE-2019-6340	502	Exec Code	2019-02-21	2020-08-24	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
40	CVE-2019-6339	20	Exec Code	2019-01-22	2019-10-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.
41	CVE-2019-6338	502		2019-01-22	2019-10-09	6.0	None	Remote	Medium	???	Partial	Partial	Partial
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
42	CVE-2018-14773			2018-08-03	2021-09-29	4.0	None	Remote	Low	???	None	Partial	None
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
43	CVE-2018-9861	79	XSS	2018-04-19	2019-07-18	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.
44	CVE-2018-7602		Exec Code	2018-07-19	2021-04-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
45	CVE-2018-7600	20	Exec Code	2018-03-29	2019-03-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
46	CVE-2017-6932	601		2018-03-01	2018-03-22	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.
47	CVE-2017-6931	434	Bypass	2018-03-01	2019-10-03	4.0	None	Remote	Low	???	None	Partial	None
In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.
48	CVE-2017-6930		Bypass	2018-03-01	2019-10-03	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().
49	CVE-2017-6929	79	XSS	2018-03-01	2018-03-21	4.3	None	Remote	Medium	Not required	None	Partial	None
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module.
50	CVE-2017-6928	732	Bypass	2018-03-01	2019-10-03	3.5	None	Remote	Medium	???	Partial	None	None
Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.

Total number of vulnerabilities : 95 Page : 1 (This Page)2