|
41
|
6.1
4.3
|
MEDIUM
Network
|
Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.…
|
CWE-79
Cross-site Scripting
|
CVE-2020-13666
|
cpe:2.3:a:drupal:drupal:*:*
|
9.0.0
8.9.0
8.8.0
7.0
|
|
|
9.0.6
8.9.6
8.8.10
7.73
|
2024-11-21 14:01
2021-05-5
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
42
|
7.5
5.0
|
HIGH
Network
|
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
|
CWE-22
CWE-59
Path Traversal
Link Following
|
CVE-2020-36193
|
cpe:2.3:a:drupal:drupal:*:*
|
9.1.0
9.0.0
7.0
8.9.0
|
|
|
9.1.3
9.0.11
7.78
8.9.13
|
2024-11-21 14:28
2021-01-19
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
43
|
8.8
6.5
|
HIGH
Network
|
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP f…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2020-13671
|
cpe:2.3:a:drupal:drupal:*:*
|
8.8
8.9
9.0
7.0
|
|
|
8.8.11
8.9.9
9.0.8
7.74
|
2024-11-21 14:01
2020-11-21
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
44
|
7.8
6.8
|
HIGH
Local
|
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2020-28948
|
cpe:2.3:a:drupal:drupal:*:*
|
7.0
8.8.0
8.0.0
9.0.0
|
|
|
7.75
8.8.12
8.9.10
9.0.9
|
2024-11-21 14:23
2020-11-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
45
|
7.8
6.8
|
HIGH
Local
|
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
|
NVD-CWE-noinfo
|
CVE-2020-28949
|
cpe:2.3:a:drupal:drupal:*:*
|
7.0
8.8.0
8.0.0
9.0.0
|
|
|
7.75
8.8.12
8.9.10
9.0.9
|
2025-03-8 02:12
2020-11-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
46
|
9.8
6.8
|
CRITICAL
Network
|
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release oth…
|
NVD-CWE-noinfo
|
CVE-2019-6342
|
cpe:2.3:a:drupal:drupal:8.7.4:*
|
|
|
|
|
2024-11-21 13:46
2020-05-29
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
47
|
6.1
4.3
|
MEDIUM
Network
|
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
|
CWE-79
Cross-site Scripting
|
CVE-2020-11022
|
cpe:2.3:a:drupal:drupal:*:*
|
7.0
8.7.0
8.8.0
|
|
|
7.70
8.7.14
8.8.6
|
2026-04-14 00:16
2020-04-30
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
48
|
6.1
4.3
|
MEDIUM
Network
|
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation m…
|
-
|
CVE-2020-11023
|
cpe:2.3:a:drupal:drupal:*:*
|
7.0
8.7.0
8.8.0
|
|
|
7.70
8.7.14
8.8.6
|
2024-11-21 13:56
2020-04-30
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
49
|
6.1
4.3
|
MEDIUM
Network
|
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with t…
|
CWE-79
Cross-site Scripting
|
CVE-2020-9281
|
cpe:2.3:a:drupal:drupal:*:*
|
8.8.0
8.7.0
|
|
|
8.8.4
8.7.12
|
2024-11-21 14:40
2020-03-7
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
50
|
9.8
7.5
|
CRITICAL
Network
|
An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
|
CWE-89
SQL Injection
|
CVE-2011-2715
|
cpe:2.3:a:drupal:drupal:6.20:*
|
|
|
|
|
2024-11-21 10:28
2020-01-15
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|