Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 029
GHSA-rgx6-rjj4-c388
ckeditor4 vulnerable to cross-site scripting
CVE-2020-13663
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
CVE-2020-13663
Cross Site Request Forgery vulnerability in Drupal Core Form API does ...
CVE-2020-13663
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
CVE-2020-13688
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
CVE-2020-13688
Cross-site scripting vulnerability in l Drupal Core allows an attacker ...
BDU:2022-06302
Уязвимость CMS-системы Drupal, связанная с недостаточной проверкой подлинности выполняемых запросов, позволяющая нарушителю выполнить произвольный код
CVE-2021-33829
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
CVE-2021-33829
A cross-site scripting (XSS) vulnerability in the HTML Data Processor ...
CVE-2021-33829
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| GHSA-rgx6-rjj4-c388 ckeditor4 vulnerable to cross-site scripting | CVSS3: 6.1 | 3% Низкий | около 5 лет назад |
 | CVE-2020-13663 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. | CVSS3: 8.8 | 1% Низкий | около 5 лет назад |
| CVE-2020-13663 Cross Site Request Forgery vulnerability in Drupal Core Form API does ... | CVSS3: 8.8 | 1% Низкий | около 5 лет назад |
 | CVE-2020-13663 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. | CVSS3: 8.8 | 1% Низкий | около 5 лет назад |
| CVE-2020-13688 Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. | CVSS3: 6.1 | 1% Низкий | около 5 лет назад |
| CVE-2020-13688 Cross-site scripting vulnerability in l Drupal Core allows an attacker ... | CVSS3: 6.1 | 1% Низкий | около 5 лет назад |
 | BDU:2022-06302 Уязвимость CMS-системы Drupal, связанная с недостаточной проверкой подлинности выполняемых запросов, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.8 | 1% Низкий | около 5 лет назад |
| CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. | CVSS3: 6.1 | 3% Низкий | около 5 лет назад |
| CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor ... | CVSS3: 6.1 | 3% Низкий | около 5 лет назад |
| CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. | CVSS3: 6.1 | 3% Низкий | около 5 лет назад |
Уязвимостей на страницу