Browse CVEs

CRITICAL 9.8 CVE-2014-5170 The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess… Storage Api Mitigation only Fix from $2,3002018-03-29 CRITICAL 9.8 CVE-2018-7600 KEVEPSS 100% Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issu… Drupal 8.3.9 / 8.4.6+ Fix from $2,3002018-03-29 HIGH 8.1 CVE-2017-6926 In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access t… Drupal 8.4.5+ Fix from $1,9502018-03-01 HIGH 8.1 CVE-2017-6930 In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a n… Drupal 8.4.5+ Fix from $1,9502018-03-01 MEDIUM 6.5 CVE-2017-6931 In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not… Drupal 8.4.5+ Fix from $1,6002018-03-01 MEDIUM 6.1 CVE-2017-6927 Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentia… Drupal 7.57 / 8.4.5+ Fix from $1,6002018-03-01 MEDIUM 6.1 CVE-2017-6929 A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact th… Drupal 7.57 / 8.4.0+ Fix from $1,6002018-03-01 MEDIUM 5.3 CVE-2017-6928 Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allow… Drupal 7.57+ Fix from $1,6002018-03-01 MEDIUM 6.1 CVE-2015-7943 Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABj… Drupal Mitigation only Fix from $1,6002017-10-18 MEDIUM 6.1 CVE-2015-2749 Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduc… Drupal Patch available Fix from $1,6002017-09-13 MEDIUM 6.1 CVE-2015-2750 Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to a… Drupal Patch available Fix from $1,6002017-09-13 HIGH 7.5 CVE-2017-6919 Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled … Drupal Patch available Fix from $1,9502017-04-20 HIGH 8.1 CVE-2017-6381 A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the def… Drupal Mitigation only Fix from $1,9502017-03-16 HIGH 7.5 CVE-2017-6377 When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resul… Drupal Mitigation only Fix from $1,9502017-03-16 HIGH 7.5 CVE-2017-6379 Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a … Drupal Mitigation only Fix from $1,9502017-03-16 MEDIUM 6.5 CVE-2016-9452 The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. Drupal Patch available Fix from $1,6002016-11-25 MEDIUM 6.8 CVE-2016-9451 Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors. Drupal Patch available Fix from $1,6002016-11-25 HIGH 7.5 CVE-2016-9450 The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a… Drupal Patch available Fix from $1,9502016-11-25 MEDIUM 6.1 CVE-2016-7571 Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors invol… Drupal Mitigation only Fix from $1,6002016-10-03 MEDIUM 5.3 CVE-2016-6212 The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypa… Drupal Mitigation only Fix from $1,6002016-09-09 HIGH 8.8 CVE-2016-6211 The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that … Drupal Mitigation only Fix from $1,9502016-09-09 HIGH 8.1 CVE-2016-3171 Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitr… Drupal Patch available Fix from $1,9502016-04-12 MEDIUM 6.4 CVE-2016-3168 The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for … Drupal Patch available Fix from $1,6002016-04-12 HIGH 7.4 CVE-2016-3167 Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redire… Drupal Patch available Fix from $1,9502016-04-12 HIGH 7.5 CVE-2016-3165 The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access re… Drupal Patch available Fix from $1,9502016-04-12 HIGH 7.4 CVE-2016-3164 Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom … Drupal Patch available Fix from $1,9502016-04-12 HIGH 8.1 CVE-2016-3162 The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or s… Drupal Patch available Fix from $1,9502016-04-12 MEDIUM 5.0 CVE-2015-6661 Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. Drupal Patch available Fix from $1,6002015-08-24 MEDIUM 6.8 CVE-2015-6660 The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF a… Drupal Patch available Fix from $1,6002015-08-24 HIGH 7.5 CVE-2015-6659 SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbi… Drupal Patch available Fix from $1,9502015-08-24