Page 5 of 47 results (0.009 seconds)

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-13670

https://notcve.org/view.php?id=CVE-2020-13670

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Una vulnerabilidad de Divulgación de Información en el módulo de archivos de Drupal Core permite a un atacante conseguir acceso a metadatos de un archivo privado permanente al que no presenta acceso al adivinar el ID del archivo. Este problema afecta a: Drupal Core versiones 8.8.x anteriores a 8.8.10; versiones 8.9.x anteriores a 8.9.6; versiones 9.0.x anteriores a 9.0.6 • https://www.drupal.org/sa-core-2020-011 • CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-13674

https://notcve.org/view.php?id=CVE-2020-13674

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability. El módulo QuickEdit no comprueba apropiadamente el acceso a las rutas, lo que podría permitir un ataque de tipo cross-site request forgery en algunas circunstancias y conllevar a posibles problemas de integridad de los datos. Los sitios sólo están afectados si el módulo QuickEdit (que viene con el perfil estándar) está instalado. • https://www.drupal.org/sa-core-2021-007 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-13675

https://notcve.org/view.php?id=CVE-2020-13675

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. Los módulos JSON:API y REST/File de Drupal permiten la carga de archivos mediante sus APIs HTTP. Los módulos no ejecutan correctamente toda la comprobación de los archivos, lo que causa una vulnerabilidad de omisión de acceso. • https://www.drupal.org/sa-core-2021-008 • CWE-284: Improper Access Control CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2020-13672

https://notcve.org/view.php?id=CVE-2020-13672

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en la API de saneo del núcleo de Drupal que no filtra apropiadamente las vulnerabilidades de tipo cross-site scripting en determinadas circunstancias. Este problema afecta a: Drupal Core versiones 9.1.x anteriores a la 9.1.7; versiones 9.0.x anteriores a la 9.0.12; versiones 8.9.x anteriores a la 8.9.14; versiones 7.x anteriores a la 7.80 • https://www.drupal.org/sa-core-2021-002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-13669

https://notcve.org/view.php?id=CVE-2020-13669

Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en el ckeditor de Drupal Core permite a un atacante inyectar una vulnerabilidad de tipo XSS. Este problema afecta a: Drupal Core versiones 8.8.x anteriores a 8.8.10.; versiones 8.9.x anteriores a 8.9.6; versiones 9.0.x anteriores a 9.0.6 • https://www.drupal.org/sa-core-2020-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •