Version 10.4.0

drupal/core

Metapackage that builds specific versions of drupal core based off of a lockfile.

Install Instructions

composer require drupal/core
Language PHP
Package URL (purl) pkg:composer/drupal/core@10.4.0

Find drupal/core vulnerabilities in your supply chain.

Scan for Free

drupal/core Vulnerabilities

Sort by
icon CVE (Latest)
  • icon CVE (Latest)
  • icon CVE (Oldest)
  • icon CVSS Score (Highest)
  • icon CVSS Score (Lowest)
CVE question mark icon CVSS Score question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
CVE-2016-3162 High 8.1 CWE-400, CWE-284 0.0018 0.55443
  • 8.0.0–8.0.3
CVE-2016-3163 High 7.5 CWE-254, CWE-307 0.00346 0.71374
  • 8.0.0–8.0.3
CVE-2016-3164 High 7.4 CWE-601 0.00291 0.68618
  • 8.0.0–8.0.3
CVE-2016-3168 Medium 6.4 CWE-494, CWE-254 0.00259 0.64774
  • 8.0.0–8.0.3
CVE-2016-3170 Medium 5.3 CWE-200 0.00495 0.75979
  • 8.0.0–8.0.3
CVE-2016-5385 High 8.1 CWE-601, CWE-284, CWE-74 0.94015 0.99364
  • 8.0.0–8.1.6
CVE-2016-6211 High 8.8 CWE-264, CWE-265 0.00208 0.58457
  • 8.0.0–8.1.2
CVE-2016-6212 Medium 5.3 CWE-200 0.0039 0.72955
  • 8.0.0–8.1.2
CVE-2016-7570 Medium 4.3 CWE-264, CWE-284 0.00098 0.41943
  • 8.0.0–8.1.9
CVE-2016-7571 Medium 6.1 CWE-79 0.00135 0.49272
  • 8.0.0–8.1.9
CVE-2016-7572 Medium 4.3 CWE-264, CWE-284 0.00099 0.42087
  • 8.0.0–8.1.9
CVE-2016-9449 Medium 4.3 CWE-200 0.00098 0.41789
  • 8.0.0–8.2.2
CVE-2016-9450 High 7.5 CWE-345, CWE-444 0.00139 0.49973
  • 8.0.0–8.2.2
CVE-2016-9451 Medium 6.8 CWE-601 0.00096 0.41413
  • 8.0.0–8.2.2
CVE-2016-9452 Medium 6.5 CWE-400, CWE-20 0.0011 0.44916
  • 8.0.0–8.2.2
CVE-2017-6379 High 7.5 CWE-352 0.00179 0.55246
  • 8.0.0–8.2.6
CVE-2017-6381 High 8.1 CWE-284, CWE-829, CWE-94 0.02548 0.89879
  • 8.0.0–8.2.6
CVE-2017-6919 High 7.5 CWE-284 0.00266 0.65356
  • 8.0.0–8.3.0
CVE-2017-6920 High 9.8 CWE-502, CWE-19 0.05221 0.92899
  • 8.0.0–8.3.3
CVE-2017-6921 Medium 5.9 CWE-284, CWE-20 0.0035 0.71555
  • 8.0.0–8.3.3
CVE-2017-6922 Medium 6.5 CWE-552, CWE-200 0.00188 0.56335
  • 8.0.0–8.3.3
CVE-2017-6923 Medium 6.5 CWE-592, CWE-862 0.00104 0.43477
  • 8.0.0–8.3.6
CVE-2017-6924 High 7.4 CWE-269, CWE-284 0.00227 0.60474
  • 8.0.0–8.3.6
CVE-2017-6925 High 9.8 CWE-284 0.00366 0.72126
  • 8.0.0–8.3.6
CVE-2017-6929 Medium 6.1 CWE-79 0.00178 0.55142
  • 8.0.0–8.4.0-beta1
CVE-2018-7600 High 9.8 CWE-20 0.97469 0.99981
  • 8.0.0–8.5.0
CVE-2018-7602 High 9.8 CWE-94 0.97003 0.99849
  • 8.0.0–8.5.2
CVE-2018-9861 Medium 6.1 CWE-79 0.00164 0.53411
  • 8.0.0–8.5.1
CVE-2019-10909 Medium 5.4 CWE-79 0.00086 0.38251
  • 8.0.0–8.6.14
CVE-2019-10910 High 9.8 CWE-89 0.0261 0.9
  • 8.0.0–8.6.14
CVE-2019-10911 High 7.5 CWE-287, CWE-200 0.00272 0.67516
  • 8.0.0–8.6.14
CVE-2019-11831 High 9.8 CWE-502, CWE-22 0.00803 0.81475
  • 8.0.0–8.7.0-beta2
CVE-2019-6338 High 8 CWE-502 0.00248 0.63882
  • 8.0.0–8.6.5
CVE-2019-6339 High 9.8 CWE-20 0.74097 0.98326
  • 8.0.0–8.6.5
CVE-2019-6340 High 8.1 CWE-502 0.97465 0.9998
  • 8.0.0–8.6.9
CVE-2019-6341 Medium 5.4 CWE-79 0.57414 0.97837
  • 8.0.0–8.6.12
CVE-2020-13662 Medium 6.1 CWE-601, CWE-79 0.00078 0.35818
  • 8.0.0–8.8.5
CVE-2020-13663 High 8.8 CWE-352 0.00073 0.33706
  • 9.0.0
  • 8.0.0–8.9.0
CVE-2020-13664 High 8.8 CWE-94, CWE-77 0.00498 0.76057
  • 9.0.0
  • 8.0.0–8.9.0
CVE-2020-13665 High 9.8 CWE-284, CWE-863 0.00308 0.69567
  • 9.0.0
  • 8.0.0–8.9.0
CVE-2020-13666 Medium 6.1 CWE-79 0.00078 0.35818
  • 9.0.0–9.0.5
  • 8.0.0–8.9.5
CVE-2020-13669 Medium 6.1 CWE-79 0.00078 0.35818
  • 9.0.0–9.0.5
  • 8.0.0–8.9.5
CVE-2020-13670 High 7.5 CWE-668 0.00224 0.60254
  • 9.0.0–9.0.5
  • 8.0.0–8.9.5
CVE-2020-13671 High 8.8 CWE-434 0.67655 0.98124
  • 9.0.0–9.0.7
  • 8.0.0–8.9.8
CVE-2020-13672 Medium 6.1 CWE-79 0.00061 0.27676
  • 9.0.0–9.1.6
  • 8.0.0–8.9.13
CVE-2020-13674 Medium 6.5 CWE-352 0.00053 0.23586
  • 9.1.0–9.2.5
  • 8.0.0–8.9.18
CVE-2020-13675 High 9.8 CWE-284, CWE-434 0.00249 0.63987
  • 9.1.0–9.2.5
  • 8.0.0–8.9.18
CVE-2020-13676 Medium 6.5 CWE-284, CWE-863 0.00092 0.40391
  • 9.1.0–9.2.5
  • 8.0.0–8.9.18
CVE-2020-13677 High 7.5 CWE-284 0.0017 0.54266
  • 9.1.0–9.2.5
  • 8.0.0–8.9.18
CVE-2020-28948 High 7.8 CWE-502, CWE-74 0.19409 0.96277
  • 9.0.0–9.0.8
  • 8.0.0–8.9.9
CVE-2020-28949 High 7.8 CWE-502, CWE-74 0.96272 0.99679
  • 9.0.0–9.0.8
  • 8.0.0–8.9.9
CVE-2022-25270 Medium 6.5 CWE-863 0.00065 0.30211
  • 9.0.0–9.3.5
  • 8.0.0–8.9.x-dev
CVE-2022-25271 High 7.5 CWE-20 0.00208 0.58454
  • 9.0.0–9.3.5
  • 8.0.0–8.9.x-dev
CVE-2022-25273 High 7.5 CWE-20 0.00057 0.25896
  • 9.0.0–9.3.11
  • 8.0.0–8.9.x-dev
CVE-2022-25275 High 7.5 CWE-200 0.00116 0.46191
  • 9.0.0–9.4.2
  • 8.0.0–8.9.x-dev
CVE-2022-25276 Medium 6.1 CWE-79 0.00056 0.25524
  • 9.0.0–9.4.2
  • 8.0.0–8.9.x-dev
CVE-2022-25277 High 7.2 CWE-94, CWE-434 0.00279 0.67923
  • 9.0.0–9.4.2
  • 8.0.0–8.9.x-dev
CVE-2022-25278 Medium 6.5 CWE-284 0.00049 0.20305
  • 9.0.0–9.4.2
  • 8.0.0–8.9.x-dev
CVE-2024-45440 Medium 5.3 CWE-209 0.00295 0.68818
  • 11.0.0–11.0.4
  • 10.0.0–10.3.5
  • 9.0.0–9.5.x-dev
  • 8.0.0–8.9.x-dev
CVE-2024-55634 High 8.1 CWE-178, CWE-289 0.00043 0.10859
  • 11.0.0–11.0.7
  • 10.0.0–10.3.8
  • 9.0.0–9.5.x-dev
  • 8.0.0–8.9.x-dev
CVE-2017-6377 High 7.5 CWE-284, CWE-863 0.00251 0.64145
  • 8.2.0–8.2.6
CVE-2017-6926 High 8.1 CWE-200 0.00065 0.30211
  • 8.4.0–8.4.4
CVE-2017-6927 Medium 6.1 CWE-79 0.00217 0.59209
  • 8.4.0–8.4.4
CVE-2017-6930 High 8.1 CWE-264, CWE-284 0.0029 0.6859
  • 8.4.0–8.4.4
CVE-2017-6931 Medium 6.5 CWE-264, CWE-284, CWE-434 0.00054 0.23755
  • 8.4.0–8.4.4
CVE-2023-5256 High 7.5 CWE-200 0.00089 0.39223
  • 10.0.0–10.1.3
  • 9.0.0–9.5.10
  • 8.7.0–8.9.x-dev
CVE-2020-13667 Medium 5.3 CWE-276 0.00084 0.37469
  • 9.0.0–9.0.5
  • 8.8.0–8.9.5
CVE-2020-13668 Medium 6.1 CWE-79 0.00073 0.34038
  • 9.0.0–9.0.5
  • 8.8.0–8.9.5
CVE-2020-13688 Medium 6.1 CWE-79 0.00078 0.35818
  • 9.0.0–9.0.5
  • 8.8.0–8.9.5
CVE-2024-12393 Medium 5.4 CWE-79 0.00043 0.10859
  • 11.0.0–11.0.7
  • 10.0.0–10.3.8
  • 9.0.0–9.5.x-dev
  • 8.8.0–8.9.x-dev
CVE-2024-55636 High 9.8 CWE-915 0.00043 0.10859
  • 11.0.0–11.0.7
  • 10.0.0–10.3.8
  • 9.0.0–9.5.x-dev
  • 8.8.0–8.9.x-dev
CVE-2024-55637 High 9.8 CWE-915 0.00043 0.10859
  • 11.0.0–11.0.7
  • 10.0.0–10.3.8
  • 9.0.0–9.5.x-dev
  • 8.8.0–8.9.x-dev
CVE-2024-55638 High 9.8 CWE-915 0.00043 0.10859
  • 10.0.0–10.3.8
  • 9.0.0–9.5.x-dev
  • 8.8.0–8.9.x-dev
CVE-2019-6342 High 9.8 CWE-20 0.00308 0.69567
  • 8.7.4
CVE-2021-33829 Medium 6.1 CWE-79 0.00721 0.80397
  • 9.0.0–9.1.8
  • 8.9.0–8.9.15
CVE-2023-31250 Medium 6.5 CWE-284, CWE-863 0.00059 0.26647
  • 10.0.0–10.0.7
  • 9.0.0–9.5.7
CVE-2022-25274 Medium 5.4 CWE-284, CWE-863 0.00049 0.20265
  • 9.3.0–9.3.11
CVE-2024-11942 Medium 5.9 CWE-390 0.00043 0.10859
  • 10.0.0–10.2.9
CVE-2024-22362 High 7.5 0.00061 0.28046
  • 9.3.6–9.3.x-dev
CVE-2024-11941 High 7.5 CWE-835 0.00043 0.10859
  • 10.1.0–10.2.1

drupal/core Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2024-55638 Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2024-55637 Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2024-55636 Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2024-55634 A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2024-45440 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2024-22362 Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a denial-of-service (DoS) condition. 9.3.6, 9.3.x-dev Major → 10.2.11
CVE-2024-12393 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2024-11942 A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10. 10.0.3, 10.0.1, 10.0.0, 10.0.7, 10.0.2, 10.0.5, 10.0.6, 10.0.4 (Show all) Minor → 10.2.11
CVE-2024-11941 A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8. 10.1.3, 10.1.6, 10.1.0, 10.2.1, 10.2.0, 10.1.7, 10.1.5, 10.1.4 (Show all) Minor → 10.2.11
CVE-2023-5256 In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. 8.7.0, 8.8.3, 8.8.2, 8.7.12, 8.7.5, 8.8.0-rc1, 8.8.4, 8.7.13 (Show all) Major → 10.2.11
CVE-2023-31250 The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating. 9.0.0, 9.1.9, 9.2.2, 9.2.3, 9.1.5, 9.0.5, 9.0.3, 9.0.1 (Show all) Major → 10.2.11
CVE-2022-25278 Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2022-25277 Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2022-25276 The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2022-25275 In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2022-25274 Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system. 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.1, 9.3.0, 9.3.6, 9.3.7 (Show all) Major → 10.2.11
CVE-2022-25273 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2022-25271 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2022-25270 The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. 8.9.0, 9.0.0, 8.9.2, 8.9.5, 8.9.15, 9.1.5, 9.0.5, 9.0.3 (Show all) Major → 10.2.11
CVE-2020-28949 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-28948 Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13688 Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2020-13677 Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13676 The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13675 Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13674 The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13672 Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13671 Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13670 Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13669 Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13668 Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2020-13667 Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. 8.8.3, 8.8.2, 8.8.4, 8.8.6, 8.8.7, 8.8.1, 8.8.5, 8.8.0 (Show all) Major → 10.2.11
CVE-2020-13666 Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13665 Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13664 Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13663 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2020-13662 Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-6342 An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. 8.7.4 Major → 10.2.11
CVE-2019-6341 In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-6340 Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.) 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-6339 In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-6338 In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-11831 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-10911 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-10910 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2019-10909 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2018-9861 Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2018-7602 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2018-7600 Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6931 In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module. 8.4.2, 8.4.1, 8.4.0, 8.4.4, 8.4.3 Major → 10.2.11
CVE-2017-6930 In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records(). 8.4.2, 8.4.1, 8.4.0, 8.4.4, 8.4.3 Major → 10.2.11
CVE-2017-6929 A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6927 Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected. 8.4.2, 8.4.1, 8.4.0, 8.4.4, 8.4.3 Major → 10.2.11
CVE-2017-6926 In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments. 8.4.2, 8.4.1, 8.4.0, 8.4.4, 8.4.3 Major → 10.2.11
CVE-2017-6925 In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6924 In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6923 In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6922 In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6921 In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6920 Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6919 Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6381 A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6379 Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2017-6377 When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass. 8.2.1, 8.2.6, 8.2.0, 8.2.3, 8.2.5, 8.2.4, 8.2.2 Major → 10.2.11
CVE-2016-9452 The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-9451 Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-9450 The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-9449 The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-7572 The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-7571 Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-7570 Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-6212 The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.0-beta2, 8.1.0-rc1, 8.1.0-beta1, 8.1.1 (Show all) Major → 10.2.11
CVE-2016-6211 The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.0-beta2, 8.1.0-rc1, 8.1.0-beta1, 8.1.1 (Show all) Major → 10.2.11
CVE-2016-5385 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. 8.0.3, 8.0.0, 8.0.2, 8.0.1, 8.1.3, 8.1.0-beta2, 8.1.6, 8.1.0-rc1 (Show all) Major → 10.2.11
CVE-2016-3170 The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in. 8.0.3, 8.0.0, 8.0.2, 8.0.1 Major → 10.2.11
CVE-2016-3168 The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability." 8.0.3, 8.0.0, 8.0.2, 8.0.1 Major → 10.2.11
CVE-2016-3164 Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation. 8.0.3, 8.0.0, 8.0.2, 8.0.1 Major → 10.2.11
CVE-2016-3163 The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method. 8.0.3, 8.0.0, 8.0.2, 8.0.1 Major → 10.2.11
CVE-2016-3162 The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files. 8.0.3, 8.0.0, 8.0.2, 8.0.1 Major → 10.2.11

Instantly see if these drupal/core vulnerabilities affect your code.

Scan for Free