Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 988
BDU:2022-02391
Уязвимость модуля Advanced Content Filter WYSIWYG-редактора CKEditor , позволяющая нарушителю обойти существующую политику ограничения доступа для HTML-элементов
BDU:2022-02008
Уязвимость модуля обработки HTML-страниц WYSIWYG-редактора CKEditor, позволяющая нарушителю осуществлять межсайтовые сценарные атаки
CVE-2021-41184
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
CVE-2021-41184
jQuery-UI is the official jQuery user interface library. Prior to vers ...
CVE-2021-41183
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
CVE-2021-41183
jQuery-UI is the official jQuery user interface library. Prior to vers ...
CVE-2021-41182
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
CVE-2021-41182
jQuery-UI is the official jQuery user interface library. Prior to vers ...
CVE-2021-41184
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
CVE-2021-41183
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | BDU:2022-02391 Уязвимость модуля Advanced Content Filter WYSIWYG-редактора CKEditor , позволяющая нарушителю обойти существующую политику ограничения доступа для HTML-элементов | CVSS3: 5.4 | 0% Низкий | около 4 лет назад |
| BDU:2022-02008 Уязвимость модуля обработки HTML-страниц WYSIWYG-редактора CKEditor, позволяющая нарушителю осуществлять межсайтовые сценарные атаки | CVSS3: 8.2 | 0% Низкий | около 4 лет назад |
 | CVE-2021-41184 jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. | CVSS3: 6.5 | 22% Средний | больше 4 лет назад |
| CVE-2021-41184 jQuery-UI is the official jQuery user interface library. Prior to vers ... | CVSS3: 6.5 | 22% Средний | больше 4 лет назад |
| CVE-2021-41183 jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
| CVE-2021-41183 jQuery-UI is the official jQuery user interface library. Prior to vers ... | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
| CVE-2021-41182 jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources. | CVSS3: 6.5 | 19% Средний | больше 4 лет назад |
| CVE-2021-41182 jQuery-UI is the official jQuery user interface library. Prior to vers ... | CVSS3: 6.5 | 19% Средний | больше 4 лет назад |
 | CVE-2021-41184 jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. | CVSS3: 6.5 | 22% Средний | больше 4 лет назад |
| CVE-2021-41183 jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
Уязвимостей на страницу