Vulnerabilities > Drupal > Drupal > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-04-26 | CVE-2023-31250 | Incorrect Authorization vulnerability in Drupal The file download facility doesn't sufficiently sanitize file paths in certain situations. | 6.5 |
| 2023-04-26 | CVE-2022-25276 | Cross-site Scripting vulnerability in Drupal The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. | 6.1 |
| 2023-04-26 | CVE-2022-25278 | Unspecified vulnerability in Drupal Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. | 6.5 |
| 2023-04-26 | CVE-2022-25274 | Incorrect Authorization vulnerability in Drupal Drupal 9.3 implemented a generic entity access API for entity revisions. | 5.4 |
| 2022-03-21 | CVE-2022-24775 | Improper Input Validation vulnerability in multiple products guzzlehttp/psr7 is a PSR-7 HTTP message library. | 5.0 |
| 2022-03-16 | CVE-2022-24728 | Cross-site Scripting vulnerability in multiple products CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. | 5.4 |
| 2022-02-17 | CVE-2022-25270 | Incorrect Authorization vulnerability in Drupal The Quick Edit module does not properly check entity access in some circumstances. | 4.0 |
| 2022-02-11 | CVE-2020-13668 | Cross-site Scripting vulnerability in Drupal Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. | 4.3 |
| 2022-02-11 | CVE-2020-13669 | Cross-site Scripting vulnerability in Drupal Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. | 4.3 |
| 2022-02-11 | CVE-2020-13670 | Exposure of Resource to Wrong Sphere vulnerability in Drupal Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. | 5.0 |