Skip to content
OpenAdvisories

Package · Alpine

drupal7

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2022-25271

    Improper input validation in Drupal core

    Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certa…

    Drupal Core drupal/core drupal7 Ubuntu Alpine Packagist
  • High 7.1
    CVE-2021-32610 EPSS 73%

    Directory Traversal in Archive_Tar

    In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

    drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist
  • High 8.8
    CVE-2020-13663

    Drupal Core Cross-Site Request Forgery (CSRF) vulnerability

    Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
  • High 7.5
    CVE-2020-36193 Exploited EPSS 71%

    Directory Traversal in Archive_Tar

    Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

    drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist
    KEV Aug 25, 2022
  • High 8.8
    CVE-2020-13671 Exploited Public exploit EPSS 36%

    Drupal core Unrestricted Upload of File with Dangerous Type

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
    KEV Jan 18, 2022
  • High 7.8
    CVE-2020-28948 Public exploit EPSS 47%

    Multiple vulnerabilities through filename manipulation in Archive_Tar

    Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

    drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist
  • High 7.8
    CVE-2020-28949 Exploited Public exploit EPSS 85%

    Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

    drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine
    KEV Aug 25, 2022
  • High 8.8
    CVE-2018-1000888 Public exploit EPSS 19%

    Archive_Tar contains Potential RCE if filename starts with phar://

    PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…

    drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist
  • High 8.1
    CVE-2018-7602 Exploited · Ransomware Public exploit EPSS 99%

    Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

    A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is relat…

    Drupal Core drupal/core drupal/drupal Ubuntu Alpine Packagist
    KEV Apr 13, 2022