| CVE-2024-55638 | CRÍTICO9.8 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the si | 10/12/2024 |
| CVE-2024-55637 | CRÍTICO9.8 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on th | 10/12/2024 |
| CVE-2024-55636 | CRÍTICO9.8 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on th | 10/12/2024 |
| CVE-2024-55634 | ALTO8.1 | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 10/12/2024 |
| CVE-2024-12393 | MEDIO5.4 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 10/12/2024 |
| CVE-2024-45440 | MEDIO5.3 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. | 29/08/2024 |
| GHSA-qf65-hph9-453r | MEDIO4.6 | Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library | 15/05/2024 |
| GHSA-j66p-fvp2-fxhj | ALTO7.8 | Drupal core Arbitrary PHP code execution | 15/05/2024 |
| GHSA-337w-fxpq-5m34 | MEDIO4.2 | Drupal core uses a vulnerable Third-party library CKEditor | 15/05/2024 |
| GHSA-wxfg-253g-m7r4 | MEDIO4.3 | Drupal core Open Redirect vulnerability | 15/05/2024 |
| GHSA-m9fv-whq2-6wmc | ALTO8.1 | Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar | 15/05/2024 |
| GHSA-5x28-3f32-x523 | MEDIO4.3 | Drupal core Access control bypass | 15/05/2024 |
| GHSA-w333-5f96-mjrr | MEDIO5.3 | Drupal core Denial of Service | 15/05/2024 |
| GHSA-jf8c-36vw-98x4 | CRÍTICO | Drupal core Remote Code Execution | 15/05/2024 |
| GHSA-jjx7-8462-w4m4 | CRÍTICO | Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | 15/05/2024 |
| GHSA-58xv-7h9r-mx3c | MEDIO | Drupal Malicious file upload with filenames stating with dot | 15/05/2024 |
| GHSA-x6v2-xmrq-574j | MEDIO5.8 | Drupal Anonymous Open Redirect | 15/05/2024 |
| GHSA-86xw-vmcx-9mj4 | MEDIO | Drupal Content moderation Access bypass | 15/05/2024 |
| GHSA-r67r-42wx-c8r7 | MEDIO | Drupal External URL injection through URL aliases leading to Open Redirect | 15/05/2024 |
| CVE-2020-13672 | MEDIO6.1 | Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80. | 11/02/2022 |