Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Drupal Core 9.3.19, 9.4.3 Clear all filters
TI-2022-08982 CVE-2022-25277 · GHSA-6955-67hm-vjjq

Unrestricted file upload in Drupal Core

Priority LOW 37

Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01422 Published 2023-04-26 Fixed in 9.4.3, 9.3.19 CWE-434
TI-2022-08981 CVE-2022-25276 · GHSA-4wfq-jc9h-vpcx

Cross-site scripting in Drupal Core

Priority LOW 28

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2023-04-26 Fixed in 9.4.3, 9.3.19 CWE-79