Catch

An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting (XSS), a flaw that allows attackers to inject malicious scripts into web pages. Approximately 15,300 instances have been identified globally. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

A remote code execution issue exists within the Field UI module (`field ui`) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than `private://`. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images.

Drupal core contains a cross-site scripting (XSS) issue due to improper neutralization of input during web page generation. The XSS filter does not sufficiently sanitize certain attributes from the integrated HTMX JavaScript library, allowing an attacker to execute malicious scripts if they can insert HTML with specific attributes.

The `rebuild.php` front controller, used to clear caches and rebuild the container when a site is in an unexpected condition, fails to correctly validate the Host header against trusted host patterns. This flaw can lead to cache poisoning, where a cache is filled with a malicious response, or an open redirect, which sends users to an attacker-controlled domain.

An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL `EntityQuery` condition handler. The issue occurs when attacker-controlled PHP array keys, such as `filter[...][condition][value][malicious key]`, are concatenated directly into SQL identifiers without proper sanitization. This vulnerability exclusively affects sites using PostgreSQL databases. Remote anonymous users can exploit this to achieve full database access, exfiltrate sensitive data, escalate privileges to Administrator, and potentially execute arbitrary shell commands on the host server via Remote Code Execution (RCE) if database permissions are misconfigured (e.g., allowing `COPY FROM PROGRAM`). Over 15,000 attack probes against approximately 6,000 sites across 65 countries have been detected, with gaming and financial services being primary targets.

Drupal core contains an improperly controlled modification of dynamically-determined object attributes, leading to Object Injection. This allows for potential manipulation of objects within the system.

An improper check for unusual or exceptional conditions exists in Drupal core, allowing for forceful browsing. This issue impacts the software's ability to handle unexpected input or situations, potentially leading to unauthorized access or information disclosure.

A flaw exists in Drupal core that allows for content spoofing through a user interface misrepresentation of critical information. This issue impacts the display of content within the application.

A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels.

The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in Drupal Ignition Error Pages. This allows for Cross-Site Scripting (XSS) attacks.

Name of the Vulnerable Software and Affected Versions: Intel SGX (affected versions not specified) Description: The issue is a side-channel timing attack against Intel SGX enclaves, which can lead to the complete compromise of Trusted Execution Environment (TEE) attestation. A proof of concept (PoC) has demonstrated key extraction in less than 4 seconds. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper neutralization of directives in statically saved code, also known as 'Static Code Injection', which allows PHP Local File Inclusion. This can potentially be exploited to access sensitive files on the server.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.8.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: The issue is related to insufficient protection of the web page structure, allowing an attacker to conduct a cross-site scripting (XSS) attack. This is due to improper neutralization of input during web page generation, which enables cross-site scripting. The problem affects Drupal Core, allowing attackers to exploit this flaw and leading to XSS. Recommendations: For Drupal Core versions 8.8.0 through 10.2.11, update to version 10.2.11 or later. For Drupal Core versions 10.3.0 through 10.3.9, update to version 10.3.9 or later. For Drupal Core versions 11.0.0 through 11.0.8, update to version 11.0.8 or later. As a temporary workaround, consider restricting the use of JavaScript to render status messages in certain cases and configurations to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9 Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of protected information. Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system, potentially allowing a malicious user to take down a site. The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur. Recommendations: For Drupal Core versions 10.0.0 through 10.2.9, update to version 10.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the CKEditor 5 module to minimize the risk of exploitation. Avoid using the module for image uploads until the issue is resolved.

The issue is related to improper neutralization of directives in statically saved code, also known as 'Static Code Injection', which allows PHP Local File Inclusion. This can be exploited by a remote attacker to execute arbitrary code.

The issue is related to the improper neutralization of directives in statically saved code, also known as 'static code injection', which allows for PHP Local File Inclusion in the Opigno group manager.