Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 988
CVE-2019-6342
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
BDU:2021-04619
Уязвимость ядра CMS-системы Drupal, связанная с недостаточной проверкой входных данных, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность
GHSA-jpcq-cgw6-v4j6
Potential XSS vulnerability in jQuery
GHSA-gxr4-xjj5-5px2
Potential XSS vulnerability in jQuery
CVE-2020-11022
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11022
In jQuery versions greater than or equal to 1.2 and before 3.5.0, pass ...
CVE-2020-11022
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11023
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11023
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, pa ...
CVE-2020-11023
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2019-6342 An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. | CVSS3: 9.8 | 0% Низкий | больше 5 лет назад |
 | BDU:2021-04619 Уязвимость ядра CMS-системы Drupal, связанная с недостаточной проверкой входных данных, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность | CVSS3: 6.1 | 1% Низкий | почти 6 лет назад |
| GHSA-jpcq-cgw6-v4j6 Potential XSS vulnerability in jQuery | CVSS3: 6.9 | 32% Средний | почти 6 лет назад |
| GHSA-gxr4-xjj5-5px2 Potential XSS vulnerability in jQuery | CVSS3: 6.9 | 19% Средний | почти 6 лет назад |
 | CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. | CVSS3: 6.9 | 19% Средний | почти 6 лет назад |
| CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, pass ... | CVSS3: 6.9 | 19% Средний | почти 6 лет назад |
| CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. | CVSS3: 6.9 | 19% Средний | почти 6 лет назад |
| CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. | CVSS3: 6.9 | 32% Средний | почти 6 лет назад |
| CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, pa ... | CVSS3: 6.9 | 32% Средний | почти 6 лет назад |
| CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. | CVSS3: 6.9 | 32% Средний | почти 6 лет назад |
Уязвимостей на страницу