Drupal.org Drupal Core vulnerabilities

Newest CVEs

• CVE-2017-6920

  Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during…

  Drupal.org · Drupal Core

  Critical9.8
• CVE-2017-6932

  Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in…

  Drupal.org · Drupal Core

  Medium4.7
• CVE-2017-6931

  In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the…

  Drupal.org · Drupal Core

  Medium6.5
• CVE-2017-6930

  In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the…

  Drupal.org · Drupal Core

  High8.1
• CVE-2017-6929

  A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it…

  Drupal.org · Drupal Core

  Medium6.1
• CVE-2017-6928

  Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the…

  Drupal.org · Drupal Core

  Medium5.3
• CVE-2017-6927

  Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially…

  Drupal.org · Drupal Core

  Medium6.1
• CVE-2017-6926

  In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are…

  Drupal.org · Drupal Core

  High8.1