Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13266 State: PUBLISHED Published: 2025-01-09T19:16:43.918Z Last Updated: 2025-01-14T16:56:00.804Z Vendors: Drupal Products: Responsive and off-canvas menu Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-030
CVE ID: CVE-2024-13267 State: PUBLISHED Published: 2025-01-09T19:17:31.582Z Last Updated: 2025-01-14T17:02:43.767Z Vendors: Drupal Products: Opigno TinCan Question Type Problem Types: CWE-96 Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-031
CVE ID: CVE-2024-13268 State: PUBLISHED Published: 2025-01-09T19:18:18.307Z Last Updated: 2025-01-31T15:38:34.720Z Vendors: Drupal Products: Opigno Problem Types: CWE-96 Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-032
CVE ID: CVE-2024-13269 State: PUBLISHED Published: 2025-01-09T19:18:49.539Z Last Updated: 2025-01-30T21:44:20.849Z Vendors: Drupal Products: Advanced Varnish Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-033
CVE ID: CVE-2024-13270 State: PUBLISHED Published: 2025-01-09T19:19:19.134Z Last Updated: 2025-01-31T15:39:55.890Z Vendors: Drupal Products: Freelinking Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-034
CVE ID: CVE-2024-13271 State: PUBLISHED Published: 2025-01-09T19:19:49.832Z Last Updated: 2025-01-31T15:40:48.433Z Vendors: Drupal Products: Content Entity Clone Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-035
CVE ID: CVE-2024-13272 State: PUBLISHED Published: 2025-01-09T19:20:41.907Z Last Updated: 2025-01-14T17:06:04.073Z Vendors: Drupal Products: Paragraphs table Problem Types: CWE-1220 Description: Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-036
CVE ID: CVE-2024-13273 State: PUBLISHED Published: 2025-01-09T19:26:21.730Z Last Updated: 2025-01-09T21:11:27.090Z Vendors: Drupal Products: Open Social Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-037
CVE ID: CVE-2024-13274 State: PUBLISHED Published: 2025-01-09T19:27:04.989Z Last Updated: 2025-01-14T17:08:25.046Z Vendors: Drupal Products: Open Social Problem Types: CWE-799 Description: Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-038
CVE ID: CVE-2024-13275 State: PUBLISHED Published: 2025-01-09T19:27:30.461Z Last Updated: 2025-01-14T17:12:15.449Z Vendors: Drupal Products: Security Kit Problem Types: CWE-843 Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-039
CVE ID: CVE-2024-13276 State: PUBLISHED Published: 2025-01-09T19:28:40.601Z Last Updated: 2025-01-10T16:34:18.557Z Vendors: Drupal Products: File Entity (fieldable files) Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-040
CVE ID: CVE-2024-13277 State: PUBLISHED Published: 2025-01-09T19:29:22.124Z Last Updated: 2025-01-10T16:32:51.861Z Vendors: Drupal Products: Smart IP Ban Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-041
CVE ID: CVE-2024-13278 State: PUBLISHED Published: 2025-01-09T19:31:12.862Z Last Updated: 2025-01-10T16:31:14.194Z Vendors: Drupal Products: Diff Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-042
CVE ID: CVE-2024-13279 State: PUBLISHED Published: 2025-01-09T19:31:45.632Z Last Updated: 2025-01-10T16:29:51.281Z Vendors: Drupal Products: Two-factor Authentication (TFA) Problem Types: CWE-384 Description: Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-043
CVE ID: CVE-2024-13280 State: PUBLISHED Published: 2025-01-09T19:34:03.443Z Last Updated: 2025-01-10T16:27:32.061Z Vendors: Drupal Products: Persistent Login Problem Types: CWE-613 Description: Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-044
CVE ID: CVE-2024-13281 State: PUBLISHED Published: 2025-01-09T19:35:17.772Z Last Updated: 2025-01-10T16:26:12.275Z Vendors: Drupal Products: Monster Menus Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-045
CVE ID: CVE-2024-13282 State: PUBLISHED Published: 2025-01-09T19:35:48.354Z Last Updated: 2025-01-10T16:19:26.559Z Vendors: Drupal Products: Block permissions Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-046
CVE ID: CVE-2024-13283 State: PUBLISHED Published: 2025-01-09T19:36:22.779Z Last Updated: 2025-01-09T21:12:31.197Z Vendors: Drupal Products: Facets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-047
CVE ID: CVE-2024-13284 State: PUBLISHED Published: 2025-01-09T19:36:54.376Z Last Updated: 2025-01-10T16:17:48.941Z Vendors: Drupal Products: Gutenberg Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-048
CVE ID: CVE-2024-13285 State: PUBLISHED Published: 2025-01-09T20:11:25.066Z Last Updated: 2025-01-10T16:15:35.781Z Vendors: Drupal Products: wkhtmltopdf Description: Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-049
CVE ID: CVE-2024-13286 State: PUBLISHED Published: 2025-01-09T20:13:01.429Z Last Updated: 2025-01-10T16:57:38.254Z Vendors: Drupal Products: SVG Embed Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-050
CVE ID: CVE-2024-13287 State: PUBLISHED Published: 2025-01-09T20:13:41.775Z Last Updated: 2025-01-10T16:56:41.515Z Vendors: Drupal Products: Views SVG Animation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-051
CVE ID: CVE-2024-13288 State: PUBLISHED Published: 2025-01-09T20:14:17.954Z Last Updated: 2025-01-10T14:51:10.361Z Vendors: Drupal Products: Monster Menus Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-052
CVE ID: CVE-2024-13289 State: PUBLISHED Published: 2025-01-09T20:15:15.665Z Last Updated: 2025-01-10T16:32:37.239Z Vendors: Drupal Products: Cookiebot + GTM Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-055
CVE ID: CVE-2024-13290 State: PUBLISHED Published: 2025-01-09T20:15:46.716Z Last Updated: 2025-01-14T15:24:02.704Z Vendors: Drupal Products: OhDear Integration Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-056
CVE ID: CVE-2024-13291 State: PUBLISHED Published: 2025-01-09T20:16:29.195Z Last Updated: 2025-01-10T18:18:04.099Z Vendors: Drupal Products: Basic HTTP Authentication Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-057
CVE ID: CVE-2024-13292 State: PUBLISHED Published: 2025-01-09T20:16:57.677Z Last Updated: 2025-01-10T16:24:56.250Z Vendors: Drupal Products: Tooltip Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-058
CVE ID: CVE-2024-13293 State: PUBLISHED Published: 2025-01-09T20:17:22.283Z Last Updated: 2025-01-10T18:15:47.262Z Vendors: Drupal Products: POST File Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-059
CVE ID: CVE-2024-13294 State: PUBLISHED Published: 2025-01-09T20:17:48.275Z Last Updated: 2025-01-10T18:13:32.595Z Vendors: Drupal Products: POST File Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-060
CVE ID: CVE-2024-13295 State: PUBLISHED Published: 2025-01-09T20:18:39.240Z Last Updated: 2025-01-10T18:12:38.191Z Vendors: Drupal Products: Node export Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-061
CVE ID: CVE-2024-13296 State: PUBLISHED Published: 2025-01-09T20:19:25.611Z Last Updated: 2025-01-10T18:11:48.262Z Vendors: Drupal Products: Mailjet Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-062
CVE ID: CVE-2024-13297 State: PUBLISHED Published: 2025-01-09T20:21:09.904Z Last Updated: 2025-01-10T18:10:59.660Z Vendors: Drupal Products: Eloqua Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-063
CVE ID: CVE-2024-13298 State: PUBLISHED Published: 2025-01-09T20:21:56.291Z Last Updated: 2025-01-10T16:16:43.369Z Vendors: Drupal Products: Tarte au Citron Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-064
CVE ID: CVE-2024-13299 State: PUBLISHED Published: 2025-01-09T20:22:31.347Z Last Updated: 2025-01-14T15:05:09.195Z Vendors: Drupal Products: Megamenu Framework Description: Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-065
CVE ID: CVE-2024-13300 State: PUBLISHED Published: 2025-01-09T20:23:03.508Z Last Updated: 2025-01-14T15:00:16.586Z Vendors: Drupal Products: Print Anything Description: Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-066
CVE ID: CVE-2024-13301 State: PUBLISHED Published: 2025-01-09T20:23:31.496Z Last Updated: 2025-01-10T16:15:41.342Z Vendors: Drupal Products: OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-067
CVE ID: CVE-2024-13302 State: PUBLISHED Published: 2025-01-09T20:24:05.171Z Last Updated: 2025-01-10T17:56:17.360Z Vendors: Drupal Products: Pages Restriction Access Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-068
CVE ID: CVE-2024-13303 State: PUBLISHED Published: 2025-01-09T20:24:30.952Z Last Updated: 2025-01-10T17:55:12.067Z Vendors: Drupal Products: Download All Files Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-069
CVE ID: CVE-2024-13304 State: PUBLISHED Published: 2025-01-09T20:25:04.098Z Last Updated: 2025-01-10T17:53:34.294Z Vendors: Drupal Products: Minify JS Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-070
CVE ID: CVE-2024-13305 State: PUBLISHED Published: 2025-01-09T20:25:32.400Z Last Updated: 2025-01-10T16:14:21.172Z Vendors: Drupal Products: Entity Form Steps Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-071
CVE ID: CVE-2024-13306 State: PUBLISHED Published: 2025-02-15T06:00:10.625Z Last Updated: 2025-02-18T20:43:12.405Z Vendors: Unknown Products: Maps Plugin using Google Maps for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ec3096f2-60fd-4654-9e95-5cf4b20b2990
lyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ec3096f2-60fd-4654-9e95-5cf4b20b2990/
CVE ID: CVE-2024-13307 State: PUBLISHED Published: 2025-04-24T08:23:51.329Z Last Updated: 2025-04-24T13:06:38.574Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: pixel_prime Products: Reales WP - Real Estate WordPress Theme Problem Types: CWE-862 Description: The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_file', 'reales_delete_file_plans', 'reales_add_to_favourites', and 'reales_remove_from_favourites' functions in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrar
ons in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary attachments, and add or remove favorite property listings for any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb94caa4-35a4-4aa3-8d25-263bbd58072a?source=cve - https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568
CVE ID: CVE-2024-13308 State: PUBLISHED Published: 2025-01-09T20:27:03.983Z Last Updated: 2025-01-30T21:38:05.749Z Vendors: Drupal Products: Browser Back Button Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-072
CVE ID: CVE-2024-13309 State: PUBLISHED Published: 2025-01-09T20:27:35.812Z Last Updated: 2025-01-30T21:33:50.068Z Vendors: Drupal Products: Login Disable Problem Types: CWE-287 Description: Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-073
CVE ID: CVE-2024-13310 State: PUBLISHED Published: 2025-01-09T20:27:59.058Z Last Updated: 2025-01-31T15:42:24.768Z Vendors: Drupal Products: Git Utilities for Drupal Description: Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-074
CVE ID: CVE-2024-13311 State: PUBLISHED Published: 2025-01-09T20:28:24.722Z Last Updated: 2025-01-31T15:43:38.167Z Vendors: Drupal Products: Allow All File Extensions for file fields Description: Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-075
CVE ID: CVE-2024-13312 State: PUBLISHED Published: 2025-01-09T20:28:53.431Z Last Updated: 2025-01-31T15:50:36.016Z Vendors: Drupal Products: Open Social Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-076
CVE ID: CVE-2024-13313 State: PUBLISHED Published: 2025-05-15T20:06:59.940Z Last Updated: 2025-05-20T19:29:00.191Z Vendors: Unknown Products: AWeber Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cc35b2f4-f1f1-4ed3-91b2-025bd5848b29/