CVE Vulnerability Catalog

The CSP log module for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects CSP log versions from 0.0.0 to 1.0.2.

The Drupal Central Authentication System (CAS) Server module contains an Open Redirect vulnerability (redirection to an untrusted site) that allows faking the source of data. The issue affects versions from 0.0.0 to 2.0.4 and from 2.1.0 to 2.1.3.

The amazee.ai Private AI Provider module for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions from 0.0.0 to 1.3.7 and from 1.4.0 to 1.4.3.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions from 0.0.0 to 2.4.0.

The Email Verification / SMS Verification / OTP Verification module for Drupal contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows authentication bypass. This issue affects versions from 0.0.0 to 2.4.0.

The Webform Submissions Delete module for Drupal contains a Missing Authorization vulnerability that allows Forceful Browsing. This issue affects versions from 0.0.0 to 1.2.0.

The Drupal Unpublished Node Permissions module contains an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Unpublished Node Permissions versions from 0.0.0 to 1.8.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions from 0.0.0 to 5.0.9.

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

Incorrect Authorization vulnerability in the Drupal Jsonapi Role Access module allows Forceful Browsing. This issue affects Jsonapi Role Access versions from 0.0.0 to 2.0.2.

The Drupal Islandora module in versions from 0.0.0 to 2.19.0 has a missing authorization vulnerability that allows forceful browsing. The flaw permits access to resources without the required permissions.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions from 0.0.0 to 1.2.7.

Missing Authorization vulnerability in the Drupal Calculate Working Days module allows Forceful Browsing. This issue affects Calculate Working Days versions from 0.0.0 to 2.0.3.

Missing Authorization vulnerability in the Drupal AI Translate module allows Forceful Browsing. This issue affects AI Translate versions from 0.0.0 to 1.3.2 and from 1.4.0 to 1.4.1.

Missing Authorization vulnerability in the Drupal AI (Artificial Intelligence) module allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.

A Stored Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.

Missing Authorization vulnerability in the Drupal Advanced Search module allows Forceful Browsing. This issue affects Advanced Search versions from 0.0.0 to 2.4.5.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions from 0.0.0 to 2.1.6.

The Drupal Mailer Plus Log module in versions from 0.0.0 to 1.2.7 inserts sensitive information into log files. This may allow remote services to be abused with stolen credentials.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.