Drupal.org / Drupal Core
8 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2017-6920 | Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certai… | CRITICAL | 9.8 | Aug 6, 2018 |
| CVE-2017-6932 | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in v… | MEDIUM | 4.7 | Mar 1, 2018 |
| CVE-2017-6931 | In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the… | MEDIUM | 6.5 | Mar 1, 2018 |
| CVE-2017-6930 | In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the… | HIGH | 8.1 | Mar 1, 2018 |
| CVE-2017-6929 | A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requ… | MEDIUM | 6.1 | Mar 1, 2018 |
| CVE-2017-6928 | Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the us… | MEDIUM | 5.3 | Mar 1, 2018 |
| CVE-2017-6927 | Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially danger… | MEDIUM | 6.1 | Mar 1, 2018 |
| CVE-2017-6926 | In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are… | HIGH | 8.1 | Mar 1, 2018 |
Showing 1 to 8 of 8 CVEs