deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13255
Published: 2025-01-09
Description: Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-202
References: https://www.drupal.org/sa-contrib-2024-019
CVE: CVE-2024-13256
Published: 2025-01-09
Description: Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1220
References: https://www.drupal.org/sa-contrib-2024-020
CVE: CVE-2024-13257
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.drupal.org/sa-contrib-2024-021
CVE: CVE-2024-13258
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://www.drupal.org/sa-contrib-2024-022
CVE: CVE-2024-13259
Published: 2025-01-09
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://www.drupal.org/sa-contrib-2024-023
CVE: CVE-2025-21598
Published: 2025-01-09
Description: An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.
This issue affects:

Junos OS: 



  *  from 21.2R3-S8 before 21.2R3-S9, 
  *  from 21.4R3-S7 before 21.4R3-S9, 
  *  from 22.2R3-S4 before 22.2R3-S5, 
  *  from 22.3R3-S2 before 22.3R3-S4, 
  *  from 22.4R3 before 22.4R3-S5, 
  *  from 23.2R2 before 23.2R2-S2, 
  *  from 23.4R1 before 23.4R2-S1, 
  *  from 24.2R1 before 24.2R1-S1, 24.2R2.


Junos OS Evolved:
  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO, 
  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO, 
  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO, 
  *  from 22.4R3-EVO before 22.4R3-S5-EVO, 
  *  from 23.2R2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4R1-EVO before 23.4R2-S1-EVO, 
  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.


This issue requires a BGP session to be established.

This issue can propagate and multiply through multiple ASes until reaching vulnerable devices.

This issue affects iBGP and eBGP.

This issue affects IPv4 and IPv6.

An indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:

For example, by issuing the command on the neighboring device:
 show log messages

Reviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:
  rpd[<pid>]: Received malformed update from <IP address> (External AS <AS#>)
and
  rpd[<pid>]: Malformed Attribute
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://supportportal.juniper.net/JSA92867; https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html
CVE: CVE-2025-22151
Published: 2025-01-09
Description: Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0.
CVSS Score: 3.7 (LOW)
CWE: CWE-843
References: https://github.com/strawberry-graphql/strawberry/commit/526eb82b70451c0e59d5a71ae9b7396f59974bd8; https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-5xh2-23cc-5jc6
CVE: CVE-2024-10215
Published: 2025-01-09
Description: The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://documentation.iqonic.design/wpbookit/versions/change-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/2d23a2b9-8476-4564-a5de-5e6cfc38ce68?source=cve
CVE: CVE-2024-13260
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-contrib-2024-024
CVE: CVE-2024-13261
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2024-025
CVE: CVE-2024-13262
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-026
CVE: CVE-2024-13263
Published: 2025-01-09
Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-96
References: https://www.drupal.org/sa-contrib-2024-027
CVE: CVE-2024-13264
Published: 2025-01-09
Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-96
References: https://www.drupal.org/sa-contrib-2024-028
CVE: CVE-2024-13265
Published: 2025-01-09
Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-96
References: https://www.drupal.org/sa-contrib-2024-029
CVE: CVE-2024-13266
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-030
CVE: CVE-2024-13267
Published: 2025-01-09
Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-96
References: https://www.drupal.org/sa-contrib-2024-031
CVE: CVE-2024-13268
Published: 2025-01-09
Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-96
References: https://www.drupal.org/sa-contrib-2024-032
CVE: CVE-2024-13269
Published: 2025-01-09
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://www.drupal.org/sa-contrib-2024-033
CVE: CVE-2024-13270
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-034
CVE: CVE-2024-13271
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-035
CVE: CVE-2024-13272
Published: 2025-01-09
Description: Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1220
References: https://www.drupal.org/sa-contrib-2024-036
CVE: CVE-2024-13273
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-037
CVE: CVE-2024-13274
Published: 2025-01-09
Description: Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799
References: https://www.drupal.org/sa-contrib-2024-038
CVE: CVE-2024-13275
Published: 2025-01-09
Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-843
References: https://www.drupal.org/sa-contrib-2024-039
CVE: CVE-2024-13276
Published: 2025-01-09
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://www.drupal.org/sa-contrib-2024-040
CVE: CVE-2024-13277
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-041
CVE: CVE-2024-13278
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-042
CVE: CVE-2024-13279
Published: 2025-01-09
Description: Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://www.drupal.org/sa-contrib-2024-043
CVE: CVE-2024-13280
Published: 2025-01-09
Description: Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://www.drupal.org/sa-contrib-2024-044
CVE: CVE-2024-13281
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-045
CVE: CVE-2024-13282
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-046
CVE: CVE-2024-13283
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-047
CVE: CVE-2024-13284
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2024-048
CVE: CVE-2024-13285
Published: 2025-01-09
Description: Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.
CVSS Score: 9.8 (CRITICAL)
References: https://www.drupal.org/sa-contrib-2024-049
CVE: CVE-2024-13286
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-050
CVE: CVE-2024-13287
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-051
CVE: CVE-2024-42898
Published: 2025-01-09
Description: A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/simalamuel/Research/tree/main/CVE-2024-42898; https://www.nagios.com/products/security/; https://github.com/simalamuel/Research/tree/main/CVE-2024-42898
CVE: CVE-2024-46505
Published: 2025-01-09
Description: Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276, CWE-312, CWE-319, CWE-798
References: https://jayaramyalla.medium.com/bloxone-business-logic-flaw-due-to-thick-client-vulnerabilities-cve-2024-46505-04a4f1966f4b
CVE: CVE-2024-54724
Published: 2025-01-09
Description: PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://phpyun.com; https://github.com/la12138la/detail/blob/main/1.md
CVE: CVE-2024-54761
Published: 2025-01-09
Description: BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/nscan9/a31982c90ab40a8e00373bf15efbf52a; https://github.com/nscan9/BigAnt-Office-Messenger-5.6.06-RCE-via-SQL-Injection/
CVE: CVE-2024-54762
Published: 2025-01-09
Description: Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yangzongzhuan/RuoYi/; https://locrian-lightning-dc7.notion.site/CVE-2024-54762-1748e5e2b1a280b4a549dcce2c4823e8
CVE: CVE-2024-54887
Published: 2025-01-09
Description: TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote device in the context of the root user.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: http://tp-link.com; https://github.com/JBince/vulnerability-research/tree/main/CVE-2024-54887
CVE: CVE-2024-55494
Published: 2025-01-09
Description: A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the op_func parameter at /occontrolpanel/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hassan-mohammed/security-findings/tree/main/CVEs/CVE-2024-55494; https://github.com/hassan-mohammed/security-findings/tree/main/CVEs/CVE-2024-55494
CVE: CVE-2024-56113
Published: 2025-01-09
Description: Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through verbose error page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-56113; https://www.motius.com/
CVE: CVE-2024-56114
Published: 2025-01-09
Description: Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from their account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-56114; https://www.e-connectsolutions.com
CVE: CVE-2024-13288
Published: 2025-01-09
Description: Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-502
References: https://www.drupal.org/sa-contrib-2024-052
CVE: CVE-2024-13289
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-055
CVE: CVE-2024-13290
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-056
CVE: CVE-2024-13291
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-057
CVE: CVE-2024-13292
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-058
CVE: CVE-2024-13293
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.
CVSS Score: 3.1 (LOW)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2024-059
CVE: CVE-2024-13294
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-060
CVE: CVE-2024-13295
Published: 2025-01-09
Description: Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://www.drupal.org/sa-contrib-2024-061
CVE: CVE-2024-13296
Published: 2025-01-09
Description: Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://www.drupal.org/sa-contrib-2024-062
CVE: CVE-2024-13297
Published: 2025-01-09
Description: Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://www.drupal.org/sa-contrib-2024-063
CVE: CVE-2024-13298
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-064
CVE: CVE-2024-13299
Published: 2025-01-09
Description: Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.
CVSS Score: 6.6 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2024-065
CVE: CVE-2024-13300
Published: 2025-01-09
Description: Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.
CVSS Score: 6.6 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2024-066
CVE: CVE-2024-13301
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-067
CVE: CVE-2024-13302
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2024-068
CVE: CVE-2024-13303
Published: 2025-01-09
Description: Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2024-069
CVE: CVE-2024-13304
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2024-070
CVE: CVE-2024-13305
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2024-071