Skip to content
OpenAdvisories

Archive

9 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /9 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

267 results · Feed

  • Critical 9.8
    CVE-2024-10215

    WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

    The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. …

    Iqonic Design WPBookit Web / CMS
  • Medium 6.3
    CVE-2024-13272

    Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036

    Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 4.3
    CVE-2024-13271

    Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

    Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.

    Drupal Content Entity Clone drupal/content_entity_clone Packagist
  • Medium 4.3
    CVE-2024-13270

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034

    Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.

    Drupal Freelinking drupal/freelinking Packagist
  • Medium 5.3
    CVE-2024-13269

    Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.

    Drupal Advanced Varnish drupal/adv_varnish Packagist
  • Medium 6.8
    CVE-2024-13268

    Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.

    Drupal Opigno
  • High 7.5
    CVE-2024-13267

    Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

    Drupal Opigno TinCan Question Type
  • Medium 5.3
    CVE-2024-13266

    Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

    Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

    Drupal Responsive and off-canvas menu drupal/responsive_menu Packagist
  • High 7.5
    CVE-2024-13265

    Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

    Drupal Opigno Learning path drupal/opigno_learning_path Packagist
  • Critical 9.8
    CVE-2024-13264

    Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

    Drupal Opigno module drupal/opigno_module Packagist
  • Medium 5.5
    CVE-2024-13263

    Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.

    Drupal Opigno group manager drupal/opigno_group_manager Packagist
  • Medium 4.8
    CVE-2024-13262

    View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.

    Drupal View Password drupal/view_password Packagist
  • Low 3.5
    CVE-2024-13261

    Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.

    Drupal Acquia DAM drupal/acquia_dam Packagist
  • High 8.8
    CVE-2024-13260

    Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

    Drupal Migrate queue importer drupal/migrate_queue_importer Packagist
  • High 7.5
    CVE-2024-13259

    Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

    Drupal Image Sizes drupal/image_sizes Packagist
  • Critical 9.8
    CVE-2024-13258

    Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

    Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

    Drupal Drupal REST & JSON API Authentication drupal/rest_api_authentication Web / CMS Packagist
  • Medium 5.3
    CVE-2024-13257

    Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

    Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.

    Drupal Commerce View Receipt drupal/commerce_view_receipt Packagist
  • High 7.5
    CVE-2024-13256

    Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

    Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.

    Drupal Email Contact drupal/email_contact Packagist
  • High 7.5
    CVE-2024-13255

    RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.

    Drupal RESTful Web Services
  • High 7.5
    CVE-2024-13254

    REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.

    Drupal REST Views drupal/rest_views Packagist
  • Critical 9.1
    CVE-2024-13253

    Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

    Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.

    Drupal Advanced PWA inc Push Notifications drupal/advanced_pwa Packagist
  • Medium 5.4
    CVE-2024-13252

    TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.

    Drupal TacJS drupal/tacjs Packagist
  • High 8.8
    CVE-2024-13251

    Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

    Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.

    Drupal Registration role drupal/registration_role Packagist
  • High 8.8
    CVE-2024-13250

    Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.

    Drupal Drupal Symfony Mailer Lite drupal/symfony_mailer_lite Web / CMS Packagist
  • Medium 5.4
    CVE-2024-13249

    Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.

    Drupal Node Access Rebuild Progressive
  • Medium 5.5
    CVE-2024-13248

    Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

    Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.

    Drupal Private content drupal/private_content Packagist
  • Medium 4.8
    CVE-2024-13247

    Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.

    Drupal Coffee drupal/coffee Packagist
  • Medium 5.3
    CVE-2024-13246

    Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.

    Drupal Node Access Rebuild Progressive drupal/node_access_rebuild_progressive Packagist
  • Medium 5.4
    CVE-2024-13245

    CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.…

    Drupal CKEditor 4 LTS - WYSIWYG HTML editor drupal/ckeditor_lts Packagist
  • Low 3.7
    CVE-2025-22151

    Strawberry GraphQL has a type resolution vulnerability

    Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic).…

    strawberry-graphql strawberry strawberry-graphql PyPI
  • High 8.8
    CVE-2024-13244

    Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.

    Drupal Migrate Tools drupal/migrate_tools Packagist
  • Medium 6.5
    CVE-2024-13243

    Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

    Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.

    Drupal Entity Delete Log drupal/entity_delete_log Packagist
  • Critical 9.1
    CVE-2024-13242

    Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

    Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.

    Drupal Swift Mailer (abandoned) drupal/swiftmailer Packagist
  • Critical 9.1
    CVE-2024-13241

    Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

    Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.

    Drupal Open Social
  • High 7.5
    CVE-2024-13240

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004

    Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.

    Drupal Open Social
  • Critical 9.8
    CVE-2024-13239

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

    Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 5.4
    CVE-2024-13238

    Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.

    Drupal Typogrify py3-typogrify drupal/typogrify Wolfi Packagist
  • High 7.5
    CVE-2025-21598

    Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash

    An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enab…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.4
    CVE-2024-13237

    File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.

    Drupal File Entity (fieldable files)
  • Low 2.1
    CVE-2025-22149

    JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

    JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or a…

    MicahParks jwkset github.com/MicahParks/jwkset Go