Skip to content
OpenAdvisories

Archive

9 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /9 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

267 results · Feed

  • High 8.8
    CVE-2025-21380

    Azure Marketplace SaaS Resources Information Disclosure Vulnerability

    Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.

    Microsoft Marketplace SaaS
  • High 8.8
    CVE-2025-21385 Public exploit EPSS 28%

    Microsoft Purview Information Disclosure Vulnerability

    A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.

    Microsoft Microsoft Purview
  • Medium 5.3
    CVE-2024-13312

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

    Drupal Open Social
  • High 7.3
    CVE-2024-13311

    Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

    Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

    Drupal Allow All File Extensions for file fields drupal/all_extensions Packagist
  • Medium 6.5
    CVE-2024-13310

    Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

    Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

    Drupal Git Utilities for Drupal drupal/git_utils Web / CMS Packagist
  • Medium 5.4
    CVE-2024-13309

    Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

    Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

    Drupal Login Disable drupal/login_disable Packagist
  • Low 3.8
    CVE-2024-13308

    Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

    Drupal Browser Back Button drupal/browser_back_button Packagist
  • Medium 4.8
    CVE-2024-13305

    Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

    Drupal Entity Form Steps drupal/entity_form_steps Packagist
  • Medium 4.5
    CVE-2024-13304

    Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

    Drupal Minify JS drupal/minifyjs Packagist
  • Medium 5.3
    CVE-2024-13303

    Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

    Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

    Drupal Download All Files drupal/download_all_files Packagist
  • Medium 5.3
    CVE-2024-13302

    Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

    Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

    Drupal Pages Restriction Access drupal/pages_restriction Packagist
  • Medium 6.1
    CVE-2024-13301

    OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sig…

    Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) drupal/miniorange_oauth_client Packagist
  • Medium 6.6
    CVE-2024-13300

    Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066

    Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

    Drupal Print Anything
  • Medium 6.6
    CVE-2024-13299

    Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

    Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

    Drupal Megamenu Framework
  • Medium 4.8
    CVE-2024-13298

    Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

    Drupal Tarte au Citron drupal/tarte_au_citron Packagist
  • Medium 6.6
    CVE-2024-13297

    Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063

    Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

    Drupal Eloqua
  • Medium 6.6
    CVE-2024-13296

    Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

    Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

    Drupal Mailjet drupal/mailjet Packagist
  • Medium 6.6
    CVE-2024-13295

    Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

    Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.

    Drupal Node export
  • Medium 5.4
    CVE-2024-13294

    POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Low 3.1
    CVE-2024-13293

    POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Medium 4.8
    CVE-2024-13292

    Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

    Drupal Tooltip drupal/tooltip Packagist
  • High 7.3
    CVE-2024-13291

    Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

    Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

    Drupal Basic HTTP Authentication
  • Medium 5.3
    CVE-2024-13290

    OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056

    Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.

    Drupal OhDear Integration drupal/ohdear_integration Packagist
  • Medium 5.4
    CVE-2024-13289

    Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

    Drupal Cookiebot + GTM drupal/cookiebot_gtm Packagist
  • Medium 4.3
    CVE-2024-13288

    Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

    Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 5.4
    CVE-2024-13287

    Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.

    Drupal Views SVG Animation drupal/views_svg_animation Packagist
  • Medium 5.4
    CVE-2024-13286

    SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.

    Drupal SVG Embed drupal/svg_embed Packagist
  • Critical 9.8
    CVE-2024-13285

    wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049

    Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.

    Drupal wkhtmltopdf drupal/wkhtmltopdf Packagist
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Medium 6.1
    CVE-2024-13283

    Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.

    Drupal Facets drupal/facets Packagist
  • High 8.8
    CVE-2024-13282

    Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046

    Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.

    Drupal Block permissions drupal/block_permissions Packagist
  • Critical 9.1
    CVE-2024-13281

    Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

    Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Critical 9.8
    CVE-2024-13280

    Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

    Drupal Persistent Login drupal/persistent_login Packagist
  • Critical 9.8
    CVE-2024-13279

    Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

    Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.1
    CVE-2024-13278

    Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

    Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

    Drupal Diff drupal/diff Packagist
  • Critical 9.1
    CVE-2024-13277

    Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

    Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.

    Drupal Smart IP Ban
  • High 7.5
    CVE-2024-13276

    File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

    Drupal File Entity (fieldable files)
  • Medium 5.3
    CVE-2024-13275

    Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

    Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

    Drupal Security Kit drupal/seckit Packagist
  • Medium 5.3
    CVE-2024-13274

    Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

    Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

    Drupal Open Social goalgorilla/open_social Packagist
  • Medium 5.4
    CVE-2024-13273

    Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before …

    Drupal Open Social