rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-13237 File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: File Entity (fieldable files)
default_status: unaffected
Credits: lang: en
value: Caroline Boyden
lang: en
value: Joseph Olstad
lang: en
value: Sascha Grossenbacher
lang: en
value: Caroline Boyden
lang: en
value: Damien McKenna
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:15:23.691Z
CVE-2024-13238 Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Typogrify
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Benji Fisher
lang: en
value: Damien McKenna
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:33:30.339Z
CVE-2024-13239 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003
Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.
Problem types: cwe_id: CWE-1390
description: CWE-1390 Weak Authentication
Affected products: vendor: Drupal
product: Two-factor Authentication (TFA)
default_status: unaffected
Credits: lang: en
value: Ide Braakman
lang: en
value: Conrad Lara
lang: en
value: Juraj Nemec
lang: en
value: João Ventura
lang: en
value: Damien McKenna
lang: en
value: Greg Knaddison
lang: en
value: Benji Fisher
lang: en
value: Heine
Published: 2025-01-09T18:35:46.333Z
CVE-2024-13240 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004
Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Drupal
product: Open Social
default_status: unaffected
Credits: lang: en
value: Corn696
lang: en
value: Corn696
lang: en
value: Tiago Siqueira
lang: en
value: Robert Ragas
lang: en
value: Damien McKenna
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:46:57.503Z
CVE-2024-13241 Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005
Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Drupal
product: Open Social
default_status: unaffected
Credits: lang: en
value: Taras Kruts
lang: en
value: SV
lang: en
value: Taras Kruts
lang: en
value: Ronald te Brake
lang: en
value: Damien McKenna
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:47:46.096Z
CVE-2024-13242 Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006
Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.
Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
Affected products: vendor: Drupal
product: Swift Mailer (abandoned)
default_status: unaffected
Credits: lang: en
value: Adam Shepherd
lang: en
value: Adam Shepherd
lang: en
value: Wayne Eaker
lang: en
value: Damien McKenna
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:49:16.322Z
CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007
Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: Entity Delete Log
default_status: unaffected
Credits: lang: en
value: Ryan Szrama
lang: en
value: Malay Nayak
lang: en
value: Virendra Singh
lang: en
value: Greg Knaddison
lang: en
value: Heine
lang: en
value: Benji Fisher
Published: 2025-01-09T18:49:49.688Z
CVE-2024-13244 Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Migrate Tools
default_status: unaffected
Credits: lang: en
value: Andreas Hennings
lang: en
value: Andreas Hennings
lang: en
value: Lucas Hedding
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:50:23.406Z
CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: CKEditor 4 LTS - WYSIWYG HTML editor
default_status: unaffected
Credits: lang: en
value: Juraj Nemec
lang: en
value: Wojciech Kukowski
lang: en
value: Jacek BogdaÅski
lang: en
value: Dawid
lang: en
value: Greg Knaddison
lang: en
value: catch
lang: en
value: cilefen
Published: 2025-01-09T18:51:18.052Z
CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
Problem types: cwe_id: CWE-282
description: CWE-282 Improper Ownership Management
Affected products: vendor: Drupal
product: Node Access Rebuild Progressive
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Pierre Rudloff
lang: en
value: Shelane French
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
Published: 2025-01-09T18:52:31.142Z
CVE-2024-13247 Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Coffee
default_status: unaffected
Credits: lang: en
value: Patrick Fey
lang: en
value: Michael Mol
lang: en
value: Klaus Purer
lang: en
value: Oliver KÃ¶hler
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:53:15.187Z
CVE-2024-13248 Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: Drupal
product: Private content
default_status: unaffected
Credits: lang: en
value: kiwimind
lang: en
value: Adam Shepherd
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T18:53:58.956Z
CVE-2024-13249 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.
Problem types: cwe_id: CWE-282
description: CWE-282 Improper Ownership Management
Affected products: vendor: Drupal
product: Node Access Rebuild Progressive
default_status: unaffected
Credits: lang: en
value: Jen Lampton
lang: en
value: Shelane French
lang: en
value: Juraj Nemec
lang: en
value: Jen Lampton
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T18:55:21.700Z
CVE-2024-13250 Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Drupal Symfony Mailer Lite
default_status: unaffected
Credits: lang: en
value: Mingsong
lang: en
value: Lee Rowlands
lang: en
value: Wayne Eaker
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Lee Rowlands
Published: 2025-01-09T18:57:50.019Z
CVE-2024-13251 Registration role - Critical - Access bypass - SA-CONTRIB-2024-015
Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: Drupal
product: Registration role
default_status: unaffected
Credits: lang: en
value: Pamela Barone
lang: en
value: Renaud Joubert
lang: en
value: Juraj Nemec
lang: en
value: Benjamin MelanÃ§on
lang: en
value: Juraj Nemec
lang: en
value: Greg Knaddison
lang: en
value: Drew Webber
Published: 2025-01-09T18:58:16.356Z
CVE-2024-13252 TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: TacJS
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Frank Mably
lang: en
value: Pierre Rudloff
lang: en
value: Greg Knaddison
Published: 2025-01-09T18:58:53.806Z
CVE-2024-13253 Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017
Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Advanced PWA inc Push Notifications
default_status: unaffected
Credits: lang: en
value: Andre Groendijk
lang: en
value: Matthew Grasmick
lang: en
value: gMaximus
lang: en
value: Greg Knaddison
lang: en
value: Michael Hess
lang: en
value: cilefen
lang: en
value: Cathy Theys
Published: 2025-01-09T18:59:22.054Z
CVE-2024-13254 REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Drupal
product: REST Views
default_status: unaffected
Credits: lang: en
value: nicxvan
lang: en
value: nicxvan
lang: en
value: Benji Fisher
lang: en
value: Greg Knaddison
lang: en
value: Cathy Theys
Published: 2025-01-09T18:59:46.386Z
CVE-2024-13255 RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.
Problem types: cwe_id: CWE-202
description: CWE-202 Exposure of Sensitive Information Through Data Queries
Affected products: vendor: Drupal
product: RESTful Web Services
default_status: unaffected
Credits: lang: en
value: Fran Garcia-Linares
lang: en
value: Neil Drumm
lang: en
value: Fran Garcia-Linares
lang: en
value: Neil Drumm
Published: 2025-01-09T19:00:43.339Z
CVE-2024-13256 Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: Drupal
product: Email Contact
default_status: unaffected
Credits: lang: en
value: Claudiu Cristea
lang: en
value: Claudiu Cristea
lang: en
value: Bálint Nagy
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: xjm
lang: en
value: Greg Knaddison
lang: en
value: xjm
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:03:47.618Z
CVE-2024-13257 Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021
Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Commerce View Receipt
default_status: unaffected
Credits: lang: en
value: Norman Kämper-Leymann
lang: en
value: Norman Kämper-Leymann
lang: en
value: Greg Mack
lang: en
value: Greg Knaddison
lang: en
value: Drew Webber
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: xjm
Published: 2025-01-09T19:04:57.424Z
CVE-2024-13258 Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022
Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Drupal REST & JSON API Authentication
default_status: unaffected
Credits: lang: en
value: Arek Suchecki
lang: en
value: solideogloria
lang: en
value: Shashank Thigale
lang: en
value: Arek Suchecki
lang: en
value: Greg Knaddison
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: David Rothstein
lang: en
value: Michael Hess
Published: 2025-01-09T19:05:29.925Z
CVE-2024-13259 Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Drupal
product: Image Sizes
default_status: unaffected
Credits: lang: en
value: DezsÅ BiczÃ³
lang: en
value: DezsÅ BiczÃ³
lang: en
value: Pascal Crott
lang: en
value: Juraj Nemec
lang: en
value: Juraj Nemec
lang: en
value: Neil Drumm
lang: en
value: Michael Hess
Published: 2025-01-09T19:11:25.339Z
CVE-2024-13260 Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Migrate queue importer
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: David Bätge
lang: en
value: Pierre Rudloff
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Michael Hess
Published: 2025-01-09T19:12:11.941Z
CVE-2024-13261 Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Acquia DAM
default_status: unaffected
Credits: lang: en
value: Matt Glaman
lang: en
value: Matt Glaman
lang: en
value: Greg Knaddison
lang: en
value: Balázs Ertl-Bakos
lang: en
value: Jakob Perry
lang: en
value: Greg Knaddison
lang: en
value: xjm
Published: 2025-01-09T19:14:19.954Z
CVE-2024-13262 View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: View Password
default_status: unaffected
Credits: lang: en
value: Ide Braakman
lang: en
value: Ana Colautti
lang: en
value: Ide Braakman
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:14:50.335Z
CVE-2024-13263 Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
Problem types: cwe_id: CWE-96
description: CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Affected products: vendor: Drupal
product: Opigno group manager
default_status: unaffected
Credits: lang: en
value: catch
lang: en
value: Marcin Grabias
lang: en
value: Yurii Boichenko
lang: en
value: Greg Knaddison
lang: en
value: Benji Fisher
Published: 2025-01-09T19:15:18.382Z
CVE-2024-13264 Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
Problem types: cwe_id: CWE-96
description: CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Affected products: vendor: Drupal
product: Opigno module
default_status: unaffected
Credits: lang: en
value: Marcin Grabias
lang: en
value: catch
lang: en
value: Yurii Boichenko
lang: en
value: Axel Minck
lang: en
value: Yuriy Korzhov
lang: en
value: Andrii Aleksandrov
lang: en
value: catch
lang: en
value: Greg Knaddison
Published: 2025-01-09T19:15:52.754Z
CVE-2024-13265 Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
Problem types: cwe_id: CWE-96
description: CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Affected products: vendor: Drupal
product: Opigno Learning path
default_status: unaffected
Credits: lang: en
value: Marcin Grabias
lang: en
value: catch
lang: en
value: Axel Minck
lang: en
value: Yuriy Korzhov
lang: en
value: Andrii Aleksandrov
lang: en
value: Yurii Boichenko
lang: en
value: Greg Knaddison
Published: 2025-01-09T19:16:21.090Z
CVE-2024-13266 Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Responsive and off-canvas menu
default_status: unaffected
Credits: lang: en
value: collinhaines
lang: en
value: Stephen Cox
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Drew Webber
Published: 2025-01-09T19:16:43.918Z
CVE-2024-13267 Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
Problem types: cwe_id: CWE-96
description: CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Affected products: vendor: Drupal
product: Opigno TinCan Question Type
default_status: unaffected
Credits: lang: en
value: Juraj Nemec
lang: en
value: Marcin Grabias
lang: en
value: catch
lang: en
value: Juraj Nemec
lang: en
value: Axel Minck
lang: en
value: Yurii Boichenko
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:17:31.582Z
CVE-2024-13268 Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
Problem types: cwe_id: CWE-96
description: CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Affected products: vendor: Drupal
product: Opigno
default_status: unaffected
Credits: lang: en
value: Yurii Boichenko
lang: en
value: Marcin Grabias
lang: en
value: catch
lang: en
value: Yurii Boichenko
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:18:18.307Z
CVE-2024-13269 Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Drupal
product: Advanced Varnish
default_status: unaffected
Credits: lang: en
value: Heine Deelstra
lang: en
value: Heine Deelstra
lang: en
value: Alexander Shumenko
lang: en
value: Greg Knaddison
Published: 2025-01-09T19:18:49.539Z
CVE-2024-13270 Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Freelinking
default_status: unaffected
Credits: lang: en
value: Matthew Radcliffe
lang: en
value: Matthew Radcliffe
lang: en
value: Gisle Hannemyr
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:19:19.134Z