# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2022-24728 |
79 |
|
XSS Bypass |
2022-03-16 |
2022-03-28 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds. |
2 |
CVE-2021-41165 |
79 |
|
XSS Bypass |
2021-11-17 |
2022-04-20 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0. |
3 |
CVE-2021-41164 |
79 |
|
XSS Bypass |
2021-11-17 |
2022-06-16 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0. |
4 |
CVE-2020-13677 |
863 |
|
Bypass |
2022-02-11 |
2022-02-18 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. |
5 |
CVE-2020-13675 |
434 |
|
Bypass |
2022-02-11 |
2022-02-18 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. |
6 |
CVE-2020-13668 |
79 |
|
XSS Bypass |
2022-02-11 |
2022-02-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. |
7 |
CVE-2020-13667 |
276 |
|
Bypass |
2021-05-17 |
2021-06-01 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. |
8 |
CVE-2020-13665 |
863 |
|
Bypass |
2021-05-05 |
2021-05-14 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1. |
9 |
CVE-2019-11831 |
22 |
|
Dir. Trav. Bypass |
2019-05-09 |
2021-10-01 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL. |
10 |
CVE-2019-6342 |
20 |
|
Bypass |
2020-05-28 |
2021-07-21 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. |
11 |
CVE-2017-6931 |
434 |
|
Bypass |
2018-03-01 |
2019-10-03 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module. |
12 |
CVE-2017-6930 |
|
|
Bypass |
2018-03-01 |
2019-10-03 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records(). |
13 |
CVE-2017-6928 |
732 |
|
Bypass |
2018-03-01 |
2019-10-03 |
3.5 |
None |
Remote |
Medium |
??? |
Partial |
None |
None |
Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations. |
14 |
CVE-2017-6922 |
552 |
|
Bypass |
2019-01-22 |
2019-10-09 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system. |
15 |
CVE-2017-6919 |
|
|
Bypass |
2017-04-20 |
2019-10-03 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. |
16 |
CVE-2017-6377 |
863 |
|
Bypass |
2017-03-16 |
2019-10-03 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass. |
17 |
CVE-2016-7572 |
264 |
|
Bypass |
2016-10-03 |
2016-10-04 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors. |
18 |
CVE-2016-6212 |
200 |
|
Bypass +Info |
2016-09-09 |
2016-11-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors. |
19 |
CVE-2016-3165 |
284 |
|
Bypass |
2016-04-12 |
2016-04-13 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition. |
20 |
CVE-2016-3162 |
284 |
|
Bypass |
2016-04-12 |
2016-04-22 |
6.5 |
None |
Remote |
Low |
??? |
Partial |
Partial |
Partial |
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files. |
21 |
CVE-2014-5020 |
264 |
|
Bypass |
2014-07-22 |
2014-07-22 |
4.9 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
None |
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field. |
22 |
CVE-2013-6386 |
310 |
|
Bypass |
2013-12-07 |
2014-01-14 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack. |
23 |
CVE-2012-5653 |
20 |
|
Exec Code Bypass |
2013-01-03 |
2017-08-29 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name. |
24 |
CVE-2011-2726 |
863 |
|
Bypass |
2019-11-15 |
2019-12-03 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL. |
25 |
CVE-2011-2687 |
264 |
|
Bypass |
2011-07-27 |
2015-09-03 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table. |
26 |
CVE-2010-3686 |
287 |
|
Bypass |
2010-09-29 |
2010-09-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
27 |
CVE-2010-3685 |
287 |
|
Bypass |
2010-09-29 |
2010-09-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
28 |
CVE-2010-3093 |
264 |
|
Bypass |
2010-09-21 |
2010-09-22 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue. |
29 |
CVE-2010-3092 |
264 |
|
Bypass |
2010-09-21 |
2010-09-22 |
5.5 |
None |
Remote |
Low |
??? |
Partial |
Partial |
None |
The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name. |
30 |
CVE-2010-3091 |
287 |
|
Bypass |
2010-09-29 |
2010-09-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
31 |
CVE-2008-4793 |
264 |
|
Bypass |
2008-10-29 |
2017-08-08 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules. |
32 |
CVE-2008-4792 |
264 |
|
Bypass |
2008-10-29 |
2018-11-02 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values. |
33 |
CVE-2008-4791 |
264 |
|
Bypass |
2008-10-29 |
2018-11-02 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors. |
34 |
CVE-2008-4790 |
264 |
|
Bypass |
2008-10-29 |
2017-08-08 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors. |
35 |
CVE-2008-4789 |
264 |
|
Bypass |
2008-10-29 |
2017-08-08 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error." |
36 |
CVE-2008-3000 |
264 |
|
Bypass |
2008-07-03 |
2017-08-08 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
The Aggregation module 5.x before 5.x-4.4 for Drupal, when node access modules are used, does not properly implement access control, which allows remote attackers to bypass intended restrictions. |
37 |
CVE-2008-2771 |
264 |
|
Bypass |
2008-06-18 |
2017-08-08 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors. |
38 |
CVE-2008-0569 |
264 |
|
Exec Code Bypass |
2008-02-05 |
2011-03-08 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
None |
The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors. |
39 |
CVE-2007-5597 |
264 |
|
Bypass |
2007-10-19 |
2018-10-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions. |
40 |
CVE-2007-1033 |
|
|
Bypass |
2007-02-21 |
2017-07-29 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Unspecified vulnerability in the Secure site 4.7.x-1.x-dev and 5.x-1.x-dev module for Drupal allows remote attackers to bypass access restrictions via a crafted URL. |
41 |
CVE-2007-0658 |
|
|
Bypass |
2007-02-01 |
2017-07-29 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote attackers to bypass the CAPTCHA test via an empty captcha element in $_SESSION. |
42 |
CVE-2007-0506 |
|
|
Bypass +Info |
2007-01-26 |
2017-07-29 |
6.0 |
None |
Remote |
Medium |
??? |
Partial |
Partial |
Partial |
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests. |
43 |
CVE-2006-4717 |
|
|
Bypass |
2006-09-12 |
2011-03-08 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
The login redirection mechanism in the Drupal 4.7 Pubcookie module before 1.2.2.4 2006/09/06 and the Drupal 4.6 Pubcookie module before 1.6.2.1 2006/09/07 allows remote attackers to bypass authentication requirements and spoof identities of arbitrary users via unspecified vectors. |
44 |
CVE-2005-3974 |
|
|
Bypass |
2005-12-03 |
2018-10-19 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
None |
Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission. |