CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-25271
https://notcve.org/view.php?id=CVE-2022-25271
16 Feb 2022 — Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. La API de formularios del núcleo de Drupal presenta una vulnerabilidad en la que determinados formularios de módulos contribuidos o personalizados pueden ser vulnerables a una comprobación ina... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13677
https://notcve.org/view.php?id=CVE-2020-13677
11 Feb 2022 — Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. En algunas circunstancias, el módulo JSON:API del núcleo de Drupal no restringe apropiadamente el acceso a determinados contenidos, lo que puede resultar en una omisión de acceso no intencionada. Los sitios que no presentan el módulo JSON:API habilitado no están afectados • https://www.drupal.org/sa-core-2021-010 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13670
https://notcve.org/view.php?id=CVE-2020-13670
11 Feb 2022 — Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Una vulnerabilidad de Divulgación de Información en el módulo de archivos de Drupal Core permite a un atacante conseguir acceso a metadatos de un archivo privado permanente... • https://www.drupal.org/sa-core-2020-011 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13675
https://notcve.org/view.php?id=CVE-2020-13675
11 Feb 2022 — Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. Los módulos JSON:API y REST/File de Drupal permiten la carga de archivos mediante sus APIs HTTP. Los módulos no ejecutan correctamente toda la comprobación de los archivos, lo que causa una vulnerabilidad de omi... • https://www.drupal.org/sa-core-2021-008 • CWE-284: Improper Access Control CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-13672
https://notcve.org/view.php?id=CVE-2020-13672
11 Feb 2022 — Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en la API de saneo del núcleo de Drupal que no filtra apropiadamente las vulnerabilidades de tipo cross-site scripting en determinadas circunstancias. Es... • https://www.drupal.org/sa-core-2021-002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13669
https://notcve.org/view.php?id=CVE-2020-13669
11 Feb 2022 — Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en el ckeditor de Drupal Core permite a un atacante inyectar una vulnerabilidad de tipo XSS. Este problema afecta a: Drupal Core versiones 8.8.x anteriores a 8.8.10.; versiones 8.9.x anteriores a 8.9.6; versiones 9.0.x anteriores a ... • https://www.drupal.org/sa-core-2020-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13668 – Access bypass in Drupal Core 8/9
https://notcve.org/view.php?id=CVE-2020-13668
11 Feb 2022 — Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Una vulnerabilidad de Omisión de Acceso en Drupal Core permite que un atacante aproveche la forma en que es renderizado el HTML de los formularios afectados para explotar la vulnerabilidad. Este problema afecta a: Drupal... • https://www.drupal.org/sa-core-2020-009 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 54EXPL: 1CVE-2021-41183 – XSS in `*Text` options of the Datepicker widget
https://notcve.org/view.php?id=CVE-2021-41183
26 Oct 2021 — jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. jQuery-UI es la biblioteca oficial de interfaz de usuario de jQuery. • https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 53EXPL: 1CVE-2021-41184 – XSS in the `of` option of the `.position()` util
https://notcve.org/view.php?id=CVE-2021-41184
26 Oct 2021 — jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. jQuery-UI es la biblioteca oficial de interfaz de usuario de jQuery. • https://github.com/gabrielolivra/Exploit-Medium-CVE-2021-41184 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13688
https://notcve.org/view.php?id=CVE-2020-13688
11 Jun 2021 — Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. Una vulnerabilidad de tipo cross-site scripting en l Drupal Core permite que un atacante pueda aprovechar la forma en que se renderiza el HTML de los formularios afectados para explotar la vulnerabilidad. Este pr... • https://www.drupal.org/sa-core-2020-009 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •