Drupal
Page 5 of 12 — Drupal CVEs from a corpus of 1185, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11022 | Medium | 6.9 | 2020-04-29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (… |
CVE-2020-11023 | Medium | 6.9 | 2020-04-29 | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it… |
CVE-2020-9281 | Medium | 6.1 | 2020-03-07 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script throu… |
CVE-2013-4226 | Medium | 6.5 | 2020-02-18 | The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote… |
CVE-2011-2715 | Critical | 9.8 | 2020-01-14 | An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names. |
CVE-2011-2714 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or la… |
CVE-2019-19826 | Critical | 9.8 | 2019-12-16 | The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demo… |
CVE-2011-3373 | Medium | 6.1 | 2019-11-25 | Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabl… |
CVE-2012-2079 | High | 8.8 | 2019-11-22 | A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal. |
CVE-2012-2078 | Medium | 4.8 | 2019-11-21 | Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal. |
CVE-2012-1637 | Medium | 4.8 | 2019-11-21 | Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal. |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2019-18856 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use ele… |
CVE-2010-2473 | Medium | 6.5 | 2019-11-07 | Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked coul… |
CVE-2010-2472 | Medium | 4.8 | 2019-11-07 | Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and… |
CVE-2010-2250 | Medium | 6.1 | 2019-11-07 | Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-s… |
CVE-2010-2471 | Medium | 6.1 | 2019-11-06 | Drupal versions 5.x and 6.x has open redirection |
CVE-2019-11876 | Medium | 6.1 | 2019-05-24 | In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malici… |
CVE-2019-10911 | High | 7.5 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authent… |
CVE-2019-10910 | Critical | 9.8 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allo… |
CVE-2019-10909 | Medium | 5.4 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lea… |
CVE-2019-11831 | Critical | 9.8 | 2019-05-09 | The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows atta… |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2019-6341 | Medium | 5.4 | 2019-03-26 | In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsys… |
CVE-2019-6340 | High | 8.1 | 2019-02-21 | Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary P… |
CVE-2019-6339 | Critical | 9.8 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar s… |
CVE-2017-6923 | Medium | 6.5 | 2019-01-22 | In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module d… |
CVE-2017-6922 | Medium | 6.5 | 2019-01-22 | In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to… |
CVE-2019-6338 | High | 8.0 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This libra… |
CVE-2018-7603 | Medium | 6.1 | 2019-01-15 | In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enab… |
CVE-2017-6921 | Medium | 5.9 | 2019-01-15 | In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site… |
CVE-2017-6924 | High | 7.4 | 2019-01-15 | In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does no… |
CVE-2017-6925 | Critical | 9.8 | 2019-01-15 | In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or… |
CVE-2017-6920 | Critical | 9.8 | 2018-08-06 | Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certai… |
CVE-2018-14773 | Medium | 6.5 | 2018-08-03 | An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0… |
CVE-2018-7602 | Critical | 9.8 | 2018-07-19 | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vec… |
CVE-2018-9861 | Medium | 6.1 | 2018-04-19 | Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in… |
CVE-2018-9205 | High | 7.5 | 2018-04-04 | Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path. |
CVE-2014-5170 | Critical | 9.8 | 2018-03-29 | The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file cont… |
CVE-2018-7600 | Critical | 9.8 | 2018-03-29 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affectin… |
CVE-2017-6932 | Medium | 4.7 | 2018-03-01 | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in v… |
CVE-2017-6931 | Medium | 6.5 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the… |
CVE-2017-6930 | High | 8.1 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the… |
CVE-2017-6929 | Medium | 6.1 | 2018-03-01 | A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requ… |
CVE-2017-6928 | Medium | 5.3 | 2018-03-01 | Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the us… |
CVE-2017-6927 | Medium | 6.1 | 2018-03-01 | Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially danger… |
CVE-2017-6926 | High | 8.1 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are… |
CVE-2015-7943 | Medium | 6.1 | 2017-10-18 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7… |
CVE-2015-7880 | Medium | 4.3 | 2017-09-13 | The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "… |
CVE-2015-2750 | Medium | 6.1 | 2017-09-13 | Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary w… |
CVE-2015-2749 | Medium | 6.1 | 2017-09-13 | Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… |
CVE-2017-6919 | High | 7.5 | 2017-04-20 | Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the si… |
CVE-2017-6381 | High | 8.1 | 2017-03-16 | A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htac… |
CVE-2017-6379 | High | 7.5 | 2017-03-16 | Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This… |
CVE-2017-6377 | High | 7.5 | 2017-03-16 | When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an… |
CVE-2016-9452 | Medium | 6.5 | 2016-11-25 | The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. |
CVE-2016-9451 | Medium | 6.8 | 2016-11-25 | Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors. |
CVE-2016-9450 | High | 7.5 | 2016-11-25 | The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct c… |
CVE-2016-9449 | Medium | 4.3 | 2016-11-25 | The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms… |
CVE-2016-7572 | Medium | 4.3 | 2016-10-03 | The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users t… |
CVE-2016-7571 | Medium | 6.1 | 2016-10-03 | Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HT… |
CVE-2016-7570 | Medium | 4.3 | 2016-10-03 | Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comment… |
CVE-2016-6212 | Medium | 5.3 | 2016-09-09 | The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intende… |
CVE-2016-6211 | High | 8.8 | 2016-09-09 | The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a… |
CVE-2016-5385 | High | 8.1 | 2016-07-19 | PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untr… |
CVE-2016-3171 | High | 8.1 | 2016-04-12 | Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code v… |
CVE-2016-3170 | Medium | 5.3 | 2016-04-12 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive usern… |
CVE-2016-3169 | High | 8.1 | 2016-04-12 | The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls th… |
CVE-2016-3168 | Medium | 6.4 | 2016-04-12 | The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests t… |
CVE-2016-3167 | High | 7.4 | 2016-04-12 | Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users t… |
CVE-2016-3166 | Medium | 5.9 | 2016-04-12 | CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject ar… |
CVE-2016-3165 | High | 7.5 | 2016-04-12 | The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions… |
CVE-2016-3164 | High | 7.4 | 2016-04-12 | Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2… |
CVE-2016-3163 | High | 7.5 | 2016-04-12 | The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of… |
CVE-2016-3162 | High | 8.1 | 2016-04-12 | The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute… |
CVE-2015-8095 | | 2015-11-09 | The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers… | |
CVE-2015-6665 | | 2015-08-24 | Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote a… | |
CVE-2015-6661 | | 2015-08-24 | Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. | |
CVE-2015-6660 | | 2015-08-24 | The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks tha… | |
CVE-2015-6659 | | 2015-08-24 | SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL… | |
CVE-2015-6658 | | 2015-08-24 | Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary w… | |
CVE-2015-3234 | | 2015-06-22 | The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from… | |
CVE-2015-3233 | | 2015-06-22 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishi… | |
CVE-2015-3232 | | 2015-06-22 | Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phish… | |
CVE-2015-3231 | | 2015-06-22 | The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed… | |
CVE-2015-2559 | | 2015-03-25 | Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same pas… | |
CVE-2010-5312 | Medium | 6.1 | 2014-11-24 | Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web… |
CVE-2014-9016 | | 2014-11-24 | The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers… | |
CVE-2014-9015 | | 2014-11-24 | Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server t… | |
CVE-2014-8734 | | 2014-11-12 | The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to c… | |
CVE-2013-7407 | | 2014-10-22 | Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via u… | |
CVE-2014-8296 | | 2014-10-16 | Cross-site scripting (XSS) vulnerability in the Modal Frame API module 6.x-1.x before 6.x-1.9 for Drupal allows remote attackers to inject arbitrary web script… | |
CVE-2014-3704 | | 2014-10-16 | The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remot… | |
CVE-2014-8765 | | 2014-10-14 | Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote a… | |
CVE-2014-8748 | | 2014-10-13 | Cross-site scripting (XSS) vulnerability in the Google Doubleclick for Publishers (DFP) module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated us… | |
CVE-2014-8747 | | 2014-10-13 | Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script… | |
CVE-2014-8746 | | 2014-10-13 | Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "a… | |
CVE-2014-8745 | | 2014-10-13 | Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated… | |
CVE-2014-8744 | | 2014-10-13 | Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer ni… | |
CVE-2014-8743 | | 2014-10-13 | Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permi… |