.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

drupal/drupal 8.3.4 vulnerabilities

81 advisories known · drupal/drupal@8.3.4 · 34 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 8.3.4

SEVERITYADVISORYPUBLISHED

CriticalDrupal Core Remote Code Execution VulnerabilityGHSA-297x-j9pm-xjggCVE-2018-7602DRUPAL-CORE-2018-004Affected >=7.0 <7.59, >=8.0 <8.4.8, >=8.5 <8.5.3, 8.0.0-alpha14 - 8.0.0-rc4, 8.5.0-alpha1 - 8.5.0-rc1Fixed in 7.59 Fixed in 8.4.8 Fixed in 8.5.3OSV source ↗3 years ago

CriticalDrupal Core Remote Code Execution VulnerabilityGHSA-7fh9-933g-885pCVE-2018-7600DRUPAL-CORE-2018-002Affected >=7.0 <7.58, >=8.0 <8.3.9, >=8.4 <8.4.6, >=8.5 <8.5.1, 8.0.0-alpha14 - 8.0.0-rc4, 8.4.0-alpha1 - 8.4.0-rc2, 8.5.0-alpha1 - 8.5.0-rc1Fixed in 7.58 Fixed in 8.3.9 Fixed in 8.4.6 Fixed in 8.5.1OSV source ↗4 years ago

CriticalDrupal Entity access bypass for entities that do not have UUIDs or have protected revisionsGHSA-f4qx-jqfq-7785CVE-2017-6925Affected >=8.0 <8.3.7, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.3.7OSV source ↗4 years ago

CriticalArbitrary PHP code execution in DrupalGHSA-8cw5-rv98-5c46CVE-2019-6339DRUPAL-CORE-2019-002Affected >=7.0.0 <7.62.0, >=8.0.0 <8.5.9, >=8.6.0 <8.6.6Fixed in 7.62.0 Fixed in 8.5.9 Fixed in 8.6.6OSV source ↗5 years ago

CriticalDirectory Traversal in typo3/phar-stream-wrapperGHSA-xv7v-rf6g-xwrcCVE-2019-11831DRUPAL-CORE-2019-007Affected >=7.0.0 <7.67.0, >=8.0.0 <8.6.16, >=8.7.0 <8.7.1Fixed in 7.67.0 Fixed in 8.6.16 Fixed in 8.7.1OSV source ↗5 years ago

CriticalDrupal core Remote Code ExecutionGHSA-jf8c-36vw-98x4Affected >=7.0 <7.60, >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 7.60 Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

CriticalDrupal Core Insufficient Contextual Links validation leads to Remote Code ExecutionGHSA-jjx7-8462-w4m4Affected >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

HighDrupal Core Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-m648-hpf8-qcjwBIT-drupal-2020-13663CVE-2020-13663DRUPAL-CORE-2020-004Affected >=7.0.0 <7.72, >=8.0.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 7.72 Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗4 years ago

HighDrupal core Unrestricted Upload of File with Dangerous TypeGHSA-68jc-v27h-vhmwBIT-drupal-2020-13671CVE-2020-13671DRUPAL-CORE-2020-012Affected >=7.0.0 <7.74, >=8.0.0 <8.8.11, >=8.9.0 <8.9.9, >=9.0.0 <9.0.8Fixed in 7.74 Fixed in 8.8.11 Fixed in 8.9.9 Fixed in 9.0.8OSV source ↗5 years ago

HighDrupal core Multiple vulnerabilities due to the use of the third-party library Archive_TarGHSA-m9fv-whq2-6wmcAffected >=7.0.0 <7.69, >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 7.69 Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

HighDrupal Core Remote Code Execution VulnerabilityGHSA-3gx6-h57h-rm27CVE-2019-6340DRUPAL-CORE-2019-003Affected >=7.0.0 <7.62.0, >=8.0.0 <8.5.11, >=8.6.0 <8.6.10Fixed in 7.62.0 Fixed in 8.5.11 Fixed in 8.6.10OSV source ↗4 years ago

HighDrupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted DataGHSA-6rmq-x2hv-vxppCVE-2019-6338DRUPAL-CORE-2019-001Affected >=7.0.0 <7.62.0, >=8.0.0 <8.5.9, >=8.6.0 <8.6.6Fixed in 7.62.0 Fixed in 8.5.9 Fixed in 8.6.6OSV source ↗7 years ago

HighDrupal core Arbitrary PHP code executionGHSA-j66p-fvp2-fxhjAffected >=7.0.0 <7.75, >=8.0.0 <8.8.12, >=8.9.0 <8.9.10, >=9.0.0 <9.0.9Fixed in 7.75 Fixed in 8.8.12 Fixed in 8.9.10 Fixed in 9.0.9OSV source ↗2 years ago

HighExposure of Resource to Wrong Sphere in Drupal CoreGHSA-mmjr-5q74-p3m4BIT-drupal-2020-13670CVE-2020-13670DRUPAL-CORE-2020-011Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗5 years ago

HighDrupal REST API can bypass comment approvalGHSA-p8g6-5mg7-9r5qCVE-2017-6924Affected >=8.0 <8.3.7, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.3.7OSV source ↗4 years ago

MediumMissing Authorization in DrupalGHSA-v3f6-f29f-rgvpCVE-2017-6923Affected >=8.0 <8.3.7, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.3.7OSV source ↗7 years ago

MediumDrupal cross site scripting vulnerabilityGHSA-5vpr-v24w-mmjjCVE-2017-6929Affected >=7.0 <7.57, >=8.0 <8.4.0, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 7.57 Fixed in 8.4.0OSV source ↗4 years ago

MediumEnhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)GHSA-g78h-pf65-46rvCVE-2018-9861DRUPAL-CORE-2018-003Affected >=8.0 <8.4.7, >=8.5 <8.5.2, 8.0.0-alpha14 - 8.0.0-rc4, 8.5.0-alpha1 - 8.5.0-rc1Fixed in 8.4.7 Fixed in 8.5.2OSV source ↗4 years ago

MediumDrupal core Cross-site Scripting (XSS) vulnerabilityGHSA-3m36-mjwj-352cBIT-drupal-2020-13672CVE-2020-13672DRUPAL-CORE-2021-002Affected >=7.0.0 <7.80, >=8.0.0 <8.9.14, >=9.0.0 <9.0.12, >=9.1.0 <9.1.7Fixed in 7.80 Fixed in 8.9.14 Fixed in 9.0.12 Fixed in 9.1.7OSV source ↗5 years ago

MediumDrupal core Cross-site Scripting (XSS) vulnerability in ckeditorGHSA-c533-c843-67h8BIT-drupal-2020-13669CVE-2020-13669DRUPAL-CORE-2020-010Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗5 years ago

MediumCross-site Scripting in Drupal CoreGHSA-m6q5-wv4x-fv6hBIT-drupal-2020-13668CVE-2020-13668Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗5 years ago

Mediumckeditor4 vulnerable to cross-site scriptingGHSA-rgx6-rjj4-c388BIT-drupal-2021-33829CVE-2021-33829DRUPAL-CORE-2021-003Affected >=7.0.0 <7.80, >=8.0.0 <8.9.16, >=9.0.0 <9.0.14, >=9.1.0 <9.1.9Fixed in 7.80 Fixed in 8.9.16 Fixed in 9.0.14 Fixed in 9.1.9OSV source ↗5 years ago

MediumDrupal core Access bypassGHSA-7cwc-fjqm-8vh8BIT-drupal-2024-55634CVE-2024-55634DRUPAL-CORE-2024-004Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.0.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

MediumDrupal Malicious file upload with filenames stating with dotGHSA-58xv-7h9r-mx3cAffected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

MediumDrupal Content moderation Access bypassGHSA-86xw-vmcx-9mj4Affected >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

MediumDrupal External URL injection through URL aliases leading to Open RedirectGHSA-r67r-42wx-c8r7Affected >=7.0 <7.60, >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 7.60 Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

MediumDrupal Anonymous Open RedirectGHSA-x6v2-xmrq-574jAffected >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

MediumDrupal Cross Site Scripting (XSS) vulnerabilityGHSA-cmmh-8mwp-gq5pCVE-2019-6341DRUPAL-CORE-2019-004Affected >=7.0.0 <7.65.0, >=8.0.0 <8.5.14, >=8.6.0 <8.6.13Fixed in 7.65.0 Fixed in 8.5.14 Fixed in 8.6.13OSV source ↗4 years ago

MediumSymfony Cross-site Scripting (XSS) vulnerabilityGHSA-g996-q5r8-w7g2CVE-2019-10909Affected >=8.0.0 <8.5.15, >=8.6.0 <8.6.15Fixed in 8.5.15 Fixed in 8.6.15OSV source ↗7 years ago

MediumDrupal Full Path DisclosureGHSA-mg8j-w93w-xjgcCVE-2024-45440Affected >=10.3.0 <10.3.6, >=11.0.0 <11.0.5, >=8.0.0 <10.2.9Fixed in 10.2.9 Fixed in 10.3.6 Fixed in 11.0.5OSV source ↗2 years ago

MediumDrupal core Denial of ServiceGHSA-w333-5f96-mjrrAffected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

MediumDrupal Cross-Site Scripting (XSS) affecting CKEditor Third-party libraryGHSA-qf65-hph9-453rAffected >=8.0.0 <8.9.16, >=9.0.0 <9.1.12, >=9.2.0 <9.2.4Fixed in 8.9.16 Fixed in 9.1.12 Fixed in 9.2.4OSV source ↗2 years ago

MediumDrupal core Access control bypass GHSA-5x28-3f32-x523Affected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

MediumDrupal core uses a vulnerable Third-party library CKEditorGHSA-337w-fxpq-5m34Affected >=8.0.0 <8.7.12, >=8.8.0 <8.8.4Fixed in 8.7.12 Fixed in 8.8.4OSV source ↗2 years ago

Does not affect 8.3.4

SEVERITYADVISORYPUBLISHED

CriticalDrupal core contains a potential PHP Object Injection vulnerabilityGHSA-938f-5r4f-h65vBIT-drupal-2024-55636CVE-2024-55636DRUPAL-CORE-2024-006Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.8.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

CriticalDrupal core contains a potential PHP Object Injection vulnerabilityGHSA-gvf2-2f4g-jqf4BIT-drupal-2024-55638CVE-2024-55638DRUPAL-CORE-2024-008Affected >=10.3.0 <10.3.9, >=7.0 <7.102, >=8.8.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 7.102OSV source ↗2 years ago

CriticalDrupal core contains a potential PHP Object Injection vulnerabilityGHSA-w6rx-9g2x-mg5gBIT-drupal-2024-55637CVE-2024-55637DRUPAL-CORE-2024-007Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.8.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

CriticalDrupal Core Access bypass vulnerabilityGHSA-wxqp-jwc9-g39xBIT-drupal-2020-13665CVE-2020-13665Affected >=8.8.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗4 years ago

CriticalDrupal PECL YAML parser unsafe object handlingGHSA-9c24-g32g-35rjCVE-2017-6920Affected >=8.0 <8.3.4, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.3.4OSV source ↗4 years ago

HighDrupal Core Arbitrary PHP code execution vulnerabilityGHSA-x72f-ggjw-v5xhBIT-drupal-2020-13664CVE-2020-13664DRUPAL-CORE-2020-005Affected >=8.8.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗4 years ago

HighDrupal Saving user accounts can sometimes grant the user all rolesGHSA-frqf-9qr4-6vxfCVE-2016-6211Affected >=7.0 <7.44Fixed in 7.44OSV source ↗4 years ago

HighDrupal saving user accounts can sometimes grant the user all rolesGHSA-q3p9-8728-wq7xCVE-2016-3169Affected >=6.0 <6.38, >=7.0 <7.43Fixed in 6.38 Fixed in 7.43OSV source ↗4 years ago

HighDrupal File upload access bypass and denial of serviceGHSA-w2pj-c8x5-jvg2CVE-2016-3162Affected >=7.0 <7.43, >=8.0 <8.0.4, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 7.43 Fixed in 8.0.4OSV source ↗4 years ago

HighDrupal arbitrary code executionGHSA-69g8-g9jq-74v7CVE-2016-3171Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

HighDrupal Comment reply form allows access to restricted contentGHSA-2p28-5mvp-2j2rCVE-2017-6926Affected >=7.0 <7.57, >=8.4.0 <8.4.5Fixed in 7.57 Fixed in 8.4.5OSV source ↗4 years ago

HighDrupal access bypass vulnerabilityGHSA-3327-jr93-7hq3CVE-2017-6930Affected >=8.4.0 <8.4.5Fixed in 8.4.5OSV source ↗4 years ago

HighDrupal Remote code executionGHSA-rhx9-3qf7-r3j7CVE-2017-6381Affected >=8.0 <8.2.7, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.2.7OSV source ↗4 years ago

HighDrupal Node Validation Bypass in the node module APIGHSA-ph2j-5hxq-gxrrCVE-2008-4793Affected >=5.0 <5.11Fixed in 5.11OSV source ↗4 years ago

HighDrupal has open redirect vulnerability in the Overlay moduleGHSA-hxg2-5c8p-ppwmCVE-2013-6389Affected >=7.0 <7.24Fixed in 7.24OSV source ↗4 years ago

HighDrupal Form API ignores access restrictions on submit buttonsGHSA-4gh5-3hqj-x3pjCVE-2016-3165Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

HighDrupal Brute force amplification attacks via XML-RPCGHSA-h3r9-pjmr-f938CVE-2016-3163Affected >=6.0 <6.38, >=7.0 <7.43Fixed in 6.38 Fixed in 7.43OSV source ↗4 years ago

HighDrupal Incorrect cache context on password reset pageGHSA-98w5-wqp9-w466CVE-2016-9450Affected >=8.0 <8.2.3, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.2.3OSV source ↗4 years ago

HighDrupal Cross-Site Request Forgery (CSRF)GHSA-gxxq-fhc7-3jv9CVE-2017-6379Affected >=8.2.0 <8.2.7Fixed in 8.2.7OSV source ↗4 years ago

HighDrupal access control bypass vulnerabilityGHSA-6hpj-9xj7-2jxxCVE-2017-6919Affected >=8.0 <8.2.8, >=8.3.0 <8.3.1, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.2.8 Fixed in 8.3.1OSV source ↗4 years ago

HighDrupal editor module incorrectly checks access to inline private filesGHSA-w7qx-vwr9-2j3rCVE-2017-6377Affected >=8.2.0 <8.2.7Fixed in 8.2.7OSV source ↗4 years ago

HighDrupal Open RedirectGHSA-836p-6p4j-35cgCVE-2016-3164Affected >=6.0 <6.38, >=7.0 <7.43, >=8.0 <8.0.4, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 6.38 Fixed in 7.43 Fixed in 8.0.4OSV source ↗4 years ago

HighDrupal Open redirect vulnerability in the drupal_goto functionGHSA-gxwx-c7m8-f95hCVE-2016-3167Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

MediumDrupal Denial of service via transliterate mechanismGHSA-jpj8-49hr-wcwvCVE-2016-9452Affected >=8.0 <8.2.3, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.2.3OSV source ↗4 years ago

MediumDrupal Settings Tray access bypassGHSA-7ffh-cjvg-fpr4CVE-2017-6931Affected >=8.4.0 <8.4.5Fixed in 8.4.5OSV source ↗4 years ago

MediumDrupal core access bypass vulnerabilityGHSA-58f3-cx8p-h8jgCVE-2017-6922Affected >=7.0 <7.56, >=8.0 <8.3.4, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 7.56 Fixed in 8.3.4OSV source ↗4 years ago

MediumDrupal Reflected file download vulnerabilityGHSA-qqxc-cppg-4xp8CVE-2016-3168Affected >=6.0 <6.38, >=7.0 <7.43Fixed in 6.38 Fixed in 7.43OSV source ↗4 years ago

MediumDrupal Core Cross-site scripting vulnerabilityGHSA-8jj2-x2gc-ggm7BIT-drupal-2020-13666CVE-2020-13666DRUPAL-CORE-2020-007Affected >=7.0.0 <7.73, >=8.8.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 7.73 Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗4 years ago

MediumDrupal Core Open Redirect vulnerabilityGHSA-gjqg-9rhv-qj67BIT-drupal-2020-13662CVE-2020-13662Affected >=7.0.0 <7.70Fixed in 7.70OSV source ↗4 years ago

MediumDrupal Cross-site scripting (XSS) vulnerabilityGHSA-vhg8-x858-7wq6CVE-2016-7571Affected >=8.0 <8.1.10, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.1.10OSV source ↗4 years ago

MediumDrupal cross-site scripting vulnerabilityGHSA-585j-5449-mf5mCVE-2017-6927Affected >=7.0 <7.57, >=8.4.0 <8.4.5Fixed in 7.57 Fixed in 8.4.5OSV source ↗4 years ago

MediumDrupal Open RedirectGHSA-wwrm-8947-4m6cCVE-2012-1589Affected >=7.0 <7.13Fixed in 7.13OSV source ↗4 years ago

MediumDrupal improper access restrictionsGHSA-vpm6-h53m-x2xfCVE-2012-2153Affected >=7.0 <7.14Fixed in 7.14OSV source ↗4 years ago

MediumDrupal vulnerable to Cross-site ScriptingGHSA-6cj8-c359-p7q9CVE-2008-3218Affected >=6.0 <6.3Fixed in 6.3OSV source ↗5 years ago

MediumDrupal CRLF injection vulnerability in the drupal_set_header functionGHSA-fg5q-r2q5-qmh3CVE-2016-3166Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

MediumDrupal file REST resource does not properly validateGHSA-h377-287m-w2r9CVE-2017-6921Affected >=8.0 <8.3.4, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.3.4OSV source ↗4 years ago

MediumDrupal Core Cross-Site Scripting (XSS)GHSA-8mvq-8h2v-j9vfBIT-drupal-2024-12393CVE-2024-12393DRUPAL-CORE-2024-003Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.8.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

MediumDrupal Core Access bypass vulnerability GHSA-x2q9-r8gm-f657BIT-drupal-2020-13667CVE-2020-13667DRUPAL-CORE-2020-008Affected >=8.8.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗4 years ago

MediumDrupal sensitive information disclosureGHSA-pqv4-xgqh-j8vhCVE-2016-3170Affected >=7.0 <7.43, >=8.0 <8.0.4, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 7.43 Fixed in 8.0.4OSV source ↗4 years ago

MediumDrupal Views can allow unauthorized users to see Statistics informationGHSA-rfxx-gxwc-923cCVE-2016-6212Affected >=8.0 <8.1.3, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.1.3OSV source ↗4 years ago

MediumDrupal access bypass vulnerabilityGHSA-66mv-q8r2-hj8wCVE-2017-6928Affected >=7.0 <7.57Fixed in 7.57OSV source ↗4 years ago

MediumDrupal external link injection vulnerabilityGHSA-wm86-w3cf-h6vmCVE-2017-6932Affected >=7.0 <7.57Fixed in 7.57OSV source ↗4 years ago

Medium Drupal core Open Redirect vulnerabilityGHSA-wxfg-253g-m7r4Affected >=7.0.0 <7.70Fixed in 7.70OSV source ↗2 years ago

MediumDrupal Users without "Administer comments" can set comment visibility on nodes they can editGHSA-6g9h-6v79-w4pcCVE-2016-7570Affected >=8.0.0 <8.1.10Fixed in 8.1.10OSV source ↗4 years ago

MediumDrupal Unprivileged access to config exportGHSA-fmqh-2j2x-vgp3CVE-2016-7572Affected >=8.0 <8.1.10, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 8.1.10OSV source ↗4 years ago

MediumDrupal sensitive information disclosureGHSA-p745-347h-hjfwCVE-2016-9449Affected >=7.0 <7.52, >=8.0 <8.2.3, 8.0.0-alpha14 - 8.0.0-rc4Fixed in 7.52 Fixed in 8.2.3OSV source ↗4 years ago

LowDrupal cross-site scripting vulnerability via actions feature and trigger moduleGHSA-pjmx-4gc6-hwv8CVE-2010-3094Affected >=6.0 <6.18Fixed in 6.18OSV source ↗4 years ago