drupal/core

3 results · Clear filters · Feed

• Medium 5.3
  CVE-2024-45440 Public exploit

  Drupal Full Path Disclosure

  core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

  Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  Aug 29, 2024
• Medium 5.4
  CVE-2019-10909 Public exploit

  Symfony Cross-site Scripting (XSS) vulnerability

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

  drupal/core symfony/symfony symfony symfony Debian Ubuntu Packagist
  May 16, 2019
• Medium 6.1
  CVE-2019-11358 Public exploit EPSS 87%

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

  mediawiki mediawiki django drupal/core Debian Ubuntu Alpine npm Packagist Maven PyPI NuGet RubyGems
  Apr 19, 2019