[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 424268
> CVE-2024-13284 [HIGH 8.8]
[PUBLISHED: 2025-01-09] [EPSS 0.20%]
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.
AFFECTED_PRODUCTS: Drupalgutenberg Gutenberg, Drupalgutenberg Gutenberg
> CVE-2024-13283 [MEDIUM 6.1]
[PUBLISHED: 2025-01-09] [EPSS 0.24%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.
AFFECTED_PRODUCTS: Facets Project Facets
> CVE-2024-13282 [HIGH 8.8]
[PUBLISHED: 2025-01-09] [EPSS 0.35%]
Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
AFFECTED_PRODUCTS: Block Permissions Project Block Permissions
> CVE-2024-13281 [CRITICAL 9.1]
[PUBLISHED: 2025-01-09] [EPSS 0.36%]
Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.
AFFECTED_PRODUCTS: Monster Menus Project Monster Menus, Monster Menus Project Monster Menus
> CVE-2024-13280 [CRITICAL 9.8]
[PUBLISHED: 2025-01-09] [EPSS 0.42%]
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
AFFECTED_PRODUCTS: Persistent Login Project Persistent Login, Persistent Login Project Persistent Login, Persistent Login Project Persistent Login
> CVE-2024-13279 [CRITICAL 9.8]
[PUBLISHED: 2025-01-09] [EPSS 0.47%]
Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
AFFECTED_PRODUCTS: Two-Factor Authentication Project Two Factor Authentication
> CVE-2024-13278 [CRITICAL 9.1]
[PUBLISHED: 2025-01-09] [EPSS 0.36%]
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
AFFECTED_PRODUCTS: Diff Project Diff, Diff Project Diff
> CVE-2024-13277 [CRITICAL 9.1]
[PUBLISHED: 2025-01-09] [EPSS 0.36%]
Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
AFFECTED_PRODUCTS: Smart Ip Ban Project Smart Ip Ban
> CVE-2024-13276 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.38%]
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.
AFFECTED_PRODUCTS: File Entity Project File Entity
> CVE-2024-13275 [MEDIUM 5.3]
[PUBLISHED: 2025-01-09] [EPSS 0.38%]
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.
AFFECTED_PRODUCTS: Security Kit Project Security Kit
> CVE-2024-13274 [MEDIUM 5.3]
[PUBLISHED: 2025-01-09] [EPSS 0.38%]
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
AFFECTED_PRODUCTS: Getopensocial Open Social, Getopensocial Open Social
> CVE-2024-13273 [MEDIUM 5.4]
[PUBLISHED: 2025-01-09] [EPSS 0.22%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11.
AFFECTED_PRODUCTS: Getopensocial Open Social, Getopensocial Open Social, Getopensocial Open Social
> CVE-2024-13272 [MEDIUM 6.3]
[PUBLISHED: 2025-01-09] [EPSS 0.25%]
Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.
AFFECTED_PRODUCTS: Paragraphs Table Project Paragraphs Table, Paragraphs Table Project Paragraphs Table
> CVE-2024-13271 [MEDIUM 4.3]
[PUBLISHED: 2025-01-09] [EPSS 0.32%]
Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
AFFECTED_PRODUCTS: Content Entity Clone Project Content Entity Clone
> CVE-2024-13270 [MEDIUM 4.3]
[PUBLISHED: 2025-01-09] [EPSS 0.32%]
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
AFFECTED_PRODUCTS: Freelinking Project Freelinking
> CVE-2024-13269 [MEDIUM 5.3]
[PUBLISHED: 2025-01-09] [EPSS 0.38%]
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
AFFECTED_PRODUCTS: Advanced Varnish Project Advanced Varnish
> CVE-2024-13268 [MEDIUM 6.8]
[PUBLISHED: 2025-01-09] [EPSS 0.47%]
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
AFFECTED_PRODUCTS: Opigno Opigno
> CVE-2024-13267 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.57%]
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
AFFECTED_PRODUCTS: Opigno Tincan Question Type
> CVE-2024-13266 [MEDIUM 5.3]
[PUBLISHED: 2025-01-09] [EPSS 0.36%]
Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.
AFFECTED_PRODUCTS: Responsive And Off-Canvas Menu Project Responsive And Off Canvas Menu
> CVE-2024-13265 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.57%]
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
AFFECTED_PRODUCTS: Opigno Learning Path
> CVE-2024-13264 [CRITICAL 9.8]
[PUBLISHED: 2025-01-09] [EPSS 0.47%]
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
AFFECTED_PRODUCTS: Opigno Opigno Module
> CVE-2024-13263 [MEDIUM 5.5]
[PUBLISHED: 2025-01-09] [EPSS 0.27%]
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
AFFECTED_PRODUCTS: Opigno Group Manager
> CVE-2024-13262 [MEDIUM 4.8]
[PUBLISHED: 2025-01-09] [EPSS 0.28%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.
AFFECTED_PRODUCTS: View Password Project View Password
> CVE-2024-13261 [LOW 3.5]
[PUBLISHED: 2025-01-09] [EPSS 0.15%]
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.
AFFECTED_PRODUCTS: Acquia Dam, Acquia Dam
> CVE-2024-13260 [HIGH 8.8]
[PUBLISHED: 2025-01-09] [EPSS 0.20%]
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.
AFFECTED_PRODUCTS: Migrate Queue Importer Project Migrate Queue Importer
> CVE-2024-10215 [CRITICAL 9.8]
[PUBLISHED: 2025-01-09] [EPSS 0.68%]
The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticate...
AFFECTED_PRODUCTS: Iqonic Wpbookit
> CVE-2025-22151 [LOW 3.7]
[PUBLISHED: 2025-01-09] [EPSS 0.39%]
Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple G...
> CVE-2025-21598 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.72%]
An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd. This issue affects: Ju...
> CVE-2024-13259 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.50%]
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
AFFECTED_PRODUCTS: Image Sizes Project Image Sizes
> CVE-2024-13258 [CRITICAL 9.8]
[PUBLISHED: 2025-01-09] [EPSS 0.66%]
Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
AFFECTED_PRODUCTS: Rest \& Json Api Authentication Project Rest \& Json Api Authentication
> CVE-2024-13257 [MEDIUM 5.3]
[PUBLISHED: 2025-01-09] [EPSS 0.29%]
Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
AFFECTED_PRODUCTS: Commerce View Receipt Project Commerce View Receipt
> CVE-2024-13256 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.42%]
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
AFFECTED_PRODUCTS: Email Contact Project Email Contact
> CVE-2024-13255 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.51%]
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.
AFFECTED_PRODUCTS: Restful Web Services Project Restful Web Services
> CVE-2024-13254 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.50%]
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.
AFFECTED_PRODUCTS: Rest Views Project Rest Views
> CVE-2024-13253 [CRITICAL 9.1]
[PUBLISHED: 2025-01-09] [EPSS 0.39%]
Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.
AFFECTED_PRODUCTS: Advanced Pwa Inc Push Notifications Project Advanced Pwa Inc Push Notifications
> CVE-2024-13252 [MEDIUM 5.4]
[PUBLISHED: 2025-01-09] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.
AFFECTED_PRODUCTS: Tacjs Project Tacjs
> CVE-2024-13251 [HIGH 8.8]
[PUBLISHED: 2025-01-09] [EPSS 0.37%]
Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.
AFFECTED_PRODUCTS: Registration Role Project Registration Role
> CVE-2024-13250 [HIGH 8.8]
[PUBLISHED: 2025-01-09] [EPSS 0.20%]
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.
AFFECTED_PRODUCTS: Drupal Symfony Mailer Lite Project Drupal Symfony Mailer Lite
> CVE-2024-13249 [MEDIUM 5.4]
[PUBLISHED: 2025-01-09] [EPSS 0.22%]
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.
AFFECTED_PRODUCTS: Node Access Rebuild Progressive Project Node Access Rebuild Progressive
> CVE-2024-13248 [MEDIUM 5.5]
[PUBLISHED: 2025-01-09] [EPSS 0.20%]
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
AFFECTED_PRODUCTS: Private Content Project Private Content
> CVE-2024-13247 [MEDIUM 4.8]
[PUBLISHED: 2025-01-09] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.
AFFECTED_PRODUCTS: Coffee Project Coffee
> CVE-2024-13246 [MEDIUM 5.3]
[PUBLISHED: 2025-01-09] [EPSS 0.27%]
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
AFFECTED_PRODUCTS: Node Access Rebuild Progressive Project Node Access Rebuild Progressive
> CVE-2024-13245 [MEDIUM 5.4]
[PUBLISHED: 2025-01-09] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.
AFFECTED_PRODUCTS: Cksource Ckeditor 4, Cksource Ckeditor 4
> CVE-2024-13244 [HIGH 8.8]
[PUBLISHED: 2025-01-09] [EPSS 0.20%]
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.
AFFECTED_PRODUCTS: Migrate Tools Project Migrate Tools, Migrate Tools Project Migrate Tools
> CVE-2024-13243 [MEDIUM 6.5]
[PUBLISHED: 2025-01-09] [EPSS 0.28%]
Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.
AFFECTED_PRODUCTS: Entity Delete Log Project Entity Delete Log
> CVE-2024-13242 [CRITICAL 9.1]
[PUBLISHED: 2025-01-09] [EPSS 0.38%]
Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.
AFFECTED_PRODUCTS: Swift Mailer Project Swift Mailer
> CVE-2024-13241 [CRITICAL 9.1]
[PUBLISHED: 2025-01-09] [EPSS 0.36%]
Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.
AFFECTED_PRODUCTS: Getopensocial Open Social
> CVE-2024-13240 [HIGH 7.5]
[PUBLISHED: 2025-01-09] [EPSS 0.38%]
Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.
AFFECTED_PRODUCTS: Getopensocial Open Social
> CVE-2024-13239 [CRITICAL 9.8]
[PUBLISHED: 2025-01-09] [EPSS 0.58%]
Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.
AFFECTED_PRODUCTS: Two-Factor Authentication Project Two Factor Authentication
> CVE-2024-13238 [MEDIUM 5.4]
[PUBLISHED: 2025-01-09] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.
AFFECTED_PRODUCTS: Typogrify Project Typogrify