CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-6929
https://notcve.org/view.php?id=CVE-2017-6929
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module. Hay una vulnerabilidad de Cross-Site Scripting (XSS) jQuery cuando se realizan peticiones Ajax a dominios no fiables. • https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html https://www.debian.org/security/2018/dsa-4123 https://www.drupal.org/sa-core-2018-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 71EXPL: 0CVE-2017-6919
https://notcve.org/view.php?id=CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. Drupal 8 en versiones anteriores a 8.2.8 y 8.3 en versiones anteriores a 8.3.1 permite elusión de acceso crítica por usuarios autenticados si el módulo RESTful Web Services (resto) está habilitado y el sitio permite solicitudes PATCH. • http://www.securityfocus.com/bid/97941 http://www.securitytracker.com/id/1038371 https://www.drupal.org/SA-CORE-2017-002 •