Vulnerabilities > Drupal
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-08-29 | CVE-2024-45440 | Information Exposure Through an Error Message vulnerability in Drupal 20230509 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. | 5.3 |
| 2024-01-16 | CVE-2024-22362 | Unspecified vulnerability in Drupal 9.3.6 Drupal contains a vulnerability with improper handling of structural elements. | 7.5 |
| 2023-09-28 | CVE-2023-5256 | Unspecified vulnerability in Drupal In certain scenarios, Drupal's JSON:API module will output error backtraces. | 7.5 |
| 2023-05-01 | CVE-2018-25085 | Cross-site Scripting vulnerability in Drupal Responsive Menus A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. | 4.8 |
| 2023-04-26 | CVE-2023-31250 | Incorrect Authorization vulnerability in Drupal The file download facility doesn't sufficiently sanitize file paths in certain situations. | 6.5 |
| 2023-04-26 | CVE-2022-25276 | Cross-site Scripting vulnerability in Drupal The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. | 6.1 |
| 2023-04-26 | CVE-2022-25277 | Unrestricted Upload of File with Dangerous Type vulnerability in Drupal Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). | 7.2 |
| 2023-04-26 | CVE-2022-25278 | Unspecified vulnerability in Drupal Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. | 6.5 |
| 2023-04-26 | CVE-2022-25273 | Improper Input Validation vulnerability in Drupal Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. | 7.5 |
| 2023-04-26 | CVE-2022-25274 | Incorrect Authorization vulnerability in Drupal Drupal 9.3 implemented a generic entity access API for entity revisions. | 5.4 |