Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/205564?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/205564?format=api", "purl": "pkg:composer/drupal/drupal@8.0.0-beta11", "type": "composer", "namespace": "drupal", "name": "drupal", "version": "8.0.0-beta11", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "10.2.11", "latest_non_vulnerable_version": "11.0.8", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40611?format=api", "vulnerability_id": "VCID-4pg6-hqge-wkcb", "summary": "File REST resource does not properly validate\nThe file REST resource does not properly validate some fields when manipulating files. the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6921", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00441", "scoring_system": "epss", "scoring_elements": "0.63541", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00441", "scoring_system": "epss", "scoring_elements": "0.63584", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6921" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6921", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6921" }, { "reference_url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple" }, { "reference_url": "https://www.drupal.org/SA-CORE-2017-003", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2017-003" }, { "reference_url": "http://www.securityfocus.com/bid/99222", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/99222" }, { "reference_url": "http://www.securitytracker.com/id/1038781", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id/1038781" }, { "reference_url": "https://github.com/advisories/GHSA-h377-287m-w2r9", "reference_id": "GHSA-h377-287m-w2r9", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-h377-287m-w2r9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56327?format=api", "purl": "pkg:composer/drupal/drupal@8.3.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.3.4" } ], "aliases": [ "CVE-2017-6921", "GHSA-h377-287m-w2r9" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4pg6-hqge-wkcb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40980?format=api", "vulnerability_id": "VCID-6c6t-kmb3-2qcm", "summary": "Cross-site Scripting\nIn Symfony, validation messages are not escaped, which can lead to XSS when user input is included.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10909", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00355", "scoring_system": "epss", "scoring_elements": "0.58063", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00355", "scoring_system": "epss", "scoring_elements": "0.58114", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10909" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19789", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19789" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10911", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10911" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml" }, { "reference_url": "https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2" }, { "reference_url": "https://www.drupal.org/sa-core-2019-005", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/sa-core-2019-005" }, { "reference_url": "https://www.synology.com/security/advisory/Synology_SA_19_19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.synology.com/security/advisory/Synology_SA_19_19" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10909", "reference_id": "CVE-2019-10909", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10909" }, { "reference_url": "https://symfony.com/cve-2019-10909", "reference_id": "CVE-2019-10909", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://symfony.com/cve-2019-10909" }, { "reference_url": "https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine", "reference_id": "CVE-2019-10909-ESCAPE-VALIDATION-MESSAGES-IN-THE-PHP-TEMPLATING-ENGINE", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine" }, { "reference_url": "https://github.com/advisories/GHSA-g996-q5r8-w7g2", "reference_id": "GHSA-g996-q5r8-w7g2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g996-q5r8-w7g2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/58016?format=api", "purl": "pkg:composer/drupal/drupal@8.5.15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/58017?format=api", "purl": "pkg:composer/drupal/drupal@8.6.15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.15" } ], "aliases": [ "CVE-2019-10909", "GHSA-g996-q5r8-w7g2" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6c6t-kmb3-2qcm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39446?format=api", "vulnerability_id": "VCID-7bq1-m8df-k3ba", "summary": "Language fallback can be incorrect on multilingual sites with node access restrictions\nWhen using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records(). Note that the update will mark the node access tables as needing a rebuild, which will take a long time on sites with a large number of nodes.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6930", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62509", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62554", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6930" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6930", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6930" }, { "reference_url": "https://www.drupal.org/sa-core-2018-001", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/sa-core-2018-001" }, { "reference_url": "https://www.drupal.org/SA-CORE-2018-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2018-001" }, { "reference_url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6930", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6930" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55106?format=api", "purl": "pkg:composer/drupal/drupal@8.4.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5" } ], "aliases": [ "CVE-2017-6930", "GHSA-3327-jr93-7hq3" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7bq1-m8df-k3ba" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38217?format=api", "vulnerability_id": "VCID-8qd6-8ckc-h3g5", "summary": "Unprivileged access to \"Administer comments\"\nUsers who have rights to edit a node can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7570", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00345", "scoring_system": "epss", "scoring_elements": "0.57382", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00345", "scoring_system": "epss", "scoring_elements": "0.5733", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7570" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7570", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7570" }, { "reference_url": "https://www.drupal.org/SA-CORE-2016-004", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2016-004" }, { "reference_url": "http://www.securityfocus.com/bid/93101", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/93101" }, { "reference_url": "http://www.securitytracker.com/id/1036886", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id/1036886" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52900?format=api", "purl": "pkg:composer/drupal/drupal@8.1.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2989-fmjz-nkby" }, { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-4pg6-hqge-wkcb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ah3h-t9qa-gudr" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dhwb-tvs2-vkht" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-ks17-b29e-73au" }, { "vulnerability": "VCID-mm13-6dhq-nqfb" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-q6zh-decq-bkau" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tbk2-zprq-27c8" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-y5mz-1wsc-w3g7" }, { "vulnerability": "VCID-z2xs-z24v-c3e5" }, { "vulnerability": "VCID-zpeb-7dhc-9kcx" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.1.10" } ], "aliases": [ "CVE-2016-7570", "GHSA-6g9h-6v79-w4pc" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8qd6-8ckc-h3g5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38257?format=api", "vulnerability_id": "VCID-dhwb-tvs2-vkht", "summary": "Unprivileged access to taxonomy terms\nModules wishing to restrict access to taxonomy terms may be incompatible with queries generated both by Drupal core as well as those generated by contributed modules like Entity Reference. As a result, information on taxonomy terms may be disclosed to unprivileged users.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-9449", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00215", "scoring_system": "epss", "scoring_elements": "0.441", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00215", "scoring_system": "epss", "scoring_elements": "0.44031", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-9449" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9449", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9449" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9451", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9451" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9449", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9449" }, { "reference_url": "https://www.drupal.org/SA-CORE-2016-005", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2016-005" }, { "reference_url": "http://www.debian.org/security/2016/dsa-3718", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2016/dsa-3718" }, { "reference_url": "http://www.securityfocus.com/bid/94367", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/94367" }, { "reference_url": "https://security.archlinux.org/ASA-201611-20", "reference_id": "ASA-201611-20", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201611-20" }, { "reference_url": "https://security.archlinux.org/AVG-74", "reference_id": "AVG-74", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-74" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52973?format=api", "purl": "pkg:composer/drupal/drupal@8.2.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2989-fmjz-nkby" }, { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-4pg6-hqge-wkcb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ah3h-t9qa-gudr" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-ks17-b29e-73au" }, { "vulnerability": "VCID-mm13-6dhq-nqfb" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-nwdx-mgsc-s3f3" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-uvmv-j9kx-jfeq" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-y5mz-1wsc-w3g7" }, { "vulnerability": "VCID-zpeb-7dhc-9kcx" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.2.3" } ], "aliases": [ "CVE-2016-9449", "GHSA-p745-347h-hjfw" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dhwb-tvs2-vkht" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39451?format=api", "vulnerability_id": "VCID-es39-uyu2-myap", "summary": "JavaScript cross-site scripting prevention is incomplete\nDrupal has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output is not auto-escaped by either Drupal 7 or Drupal 8). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6927", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0139", "scoring_system": "epss", "scoring_elements": "0.80691", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.0139", "scoring_system": "epss", "scoring_elements": "0.80718", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6927" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6927", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6927" }, { "reference_url": "https://www.debian.org/security/2018/dsa-4123", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2018/dsa-4123" }, { "reference_url": "https://www.drupal.org/sa-core-2018-001", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/sa-core-2018-001" }, { "reference_url": "https://www.drupal.org/SA-CORE-2018-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2018-001" }, { "reference_url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6927", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6927" }, { "reference_url": "http://www.securityfocus.com/bid/103138", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/103138" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55106?format=api", "purl": "pkg:composer/drupal/drupal@8.4.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5" } ], "aliases": [ "CVE-2017-6927", "GHSA-585j-5449-mf5m" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-es39-uyu2-myap" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38219?format=api", "vulnerability_id": "VCID-jb63-xjup-1khv", "summary": "Unprivileged access to config export\nThe `system.temporary` route allows the download of a full config export. The full config export should be limited to those with \"Export configuration\" permission.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7572", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00252", "scoring_system": "epss", "scoring_elements": "0.48818", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00252", "scoring_system": "epss", "scoring_elements": "0.48757", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7572" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7572", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7572" }, { "reference_url": "https://www.drupal.org/SA-CORE-2016-004", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2016-004" }, { "reference_url": "http://www.securityfocus.com/bid/93101", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/93101" }, { "reference_url": "http://www.securitytracker.com/id/1036886", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id/1036886" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52900?format=api", "purl": "pkg:composer/drupal/drupal@8.1.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2989-fmjz-nkby" }, { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-4pg6-hqge-wkcb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ah3h-t9qa-gudr" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dhwb-tvs2-vkht" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-ks17-b29e-73au" }, { "vulnerability": "VCID-mm13-6dhq-nqfb" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-q6zh-decq-bkau" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tbk2-zprq-27c8" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-y5mz-1wsc-w3g7" }, { "vulnerability": "VCID-z2xs-z24v-c3e5" }, { "vulnerability": "VCID-zpeb-7dhc-9kcx" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.1.10" } ], "aliases": [ "CVE-2016-7572", "GHSA-fmqh-2j2x-vgp3" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jb63-xjup-1khv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38258?format=api", "vulnerability_id": "VCID-q6zh-decq-bkau", "summary": "Incorrect cache context on password reset page\nThe user password reset form does not specify a proper cache context, which can lead to cache poisoning and unwanted content on the page.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-9450", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00227", "scoring_system": "epss", "scoring_elements": "0.45497", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00227", "scoring_system": "epss", "scoring_elements": "0.45566", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-9450" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9450.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9450.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9450.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9450.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9450", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9450" }, { "reference_url": "https://www.drupal.org/SA-CORE-2016-005", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2016-005" }, { "reference_url": "http://www.securityfocus.com/bid/94367", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/94367" }, { "reference_url": "https://security.archlinux.org/ASA-201611-20", "reference_id": "ASA-201611-20", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201611-20" }, { "reference_url": "https://security.archlinux.org/AVG-74", "reference_id": "AVG-74", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-74" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52973?format=api", "purl": "pkg:composer/drupal/drupal@8.2.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2989-fmjz-nkby" }, { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-4pg6-hqge-wkcb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ah3h-t9qa-gudr" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-ks17-b29e-73au" }, { "vulnerability": "VCID-mm13-6dhq-nqfb" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-nwdx-mgsc-s3f3" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-uvmv-j9kx-jfeq" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-y5mz-1wsc-w3g7" }, { "vulnerability": "VCID-zpeb-7dhc-9kcx" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.2.3" } ], "aliases": [ "CVE-2016-9450", "GHSA-98w5-wqp9-w466" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q6zh-decq-bkau" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39445?format=api", "vulnerability_id": "VCID-tbhc-6qre-7kc5", "summary": "Comment reply form allows access to restricted content\nUsers with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.", "references": [ { "reference_url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6926", "reference_id": "", "reference_type": "", "scores": [], "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6926" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6926", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00366", "scoring_system": "epss", "scoring_elements": "0.58843", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00366", "scoring_system": "epss", "scoring_elements": "0.5889", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6926" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6926", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6926" }, { "reference_url": "https://www.drupal.org/sa-core-2018-001", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/sa-core-2018-001" }, { "reference_url": "https://www.drupal.org/SA-CORE-2018-001", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/SA-CORE-2018-001" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55106?format=api", "purl": "pkg:composer/drupal/drupal@8.4.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5" } ], "aliases": [ "CVE-2017-6926", "GHSA-2p28-5mvp-2j2r" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tbhc-6qre-7kc5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38221?format=api", "vulnerability_id": "VCID-ughj-q27r-yfe2", "summary": "Cross-site Scripting in HTTP exceptions\nAn attacker can create a specially crafted url, which can execute arbitrary code in the victim’s browser if loaded. Drupal is not properly sanitizing an exception.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7571", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0039", "scoring_system": "epss", "scoring_elements": "0.60378", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.0039", "scoring_system": "epss", "scoring_elements": "0.60425", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-7571" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7571.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7571.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7571.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7571.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7571", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7571" }, { "reference_url": "https://www.drupal.org/SA-CORE-2016-004", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2016-004" }, { "reference_url": "http://www.securityfocus.com/bid/93101", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/93101" }, { "reference_url": "http://www.securitytracker.com/id/1036886", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id/1036886" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52900?format=api", "purl": "pkg:composer/drupal/drupal@8.1.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2989-fmjz-nkby" }, { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-4pg6-hqge-wkcb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ah3h-t9qa-gudr" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dhwb-tvs2-vkht" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-ks17-b29e-73au" }, { "vulnerability": "VCID-mm13-6dhq-nqfb" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-q6zh-decq-bkau" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tbk2-zprq-27c8" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-y5mz-1wsc-w3g7" }, { "vulnerability": "VCID-z2xs-z24v-c3e5" }, { "vulnerability": "VCID-zpeb-7dhc-9kcx" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.1.10" } ], "aliases": [ "CVE-2016-7571", "GHSA-vhg8-x858-7wq6" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ughj-q27r-yfe2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40633?format=api", "vulnerability_id": "VCID-y5mz-1wsc-w3g7", "summary": "Files uploaded by anonymous users accessed by other users\nPrivate files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core does not provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6922", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01704", "scoring_system": "epss", "scoring_elements": "0.82674", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.01704", "scoring_system": "epss", "scoring_elements": "0.82647", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6922" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6922", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6922" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6922", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6922" }, { "reference_url": "https://www.debian.org/security/2017/dsa-3897", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2017/dsa-3897" }, { "reference_url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple" }, { "reference_url": "https://www.drupal.org/SA-CORE-2017-003", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2017-003" }, { "reference_url": "http://www.securityfocus.com/bid/99219", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/99219" }, { "reference_url": "http://www.securitytracker.com/id/1038781", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id/1038781" }, { "reference_url": "https://github.com/advisories/GHSA-58f3-cx8p-h8jg", "reference_id": "GHSA-58f3-cx8p-h8jg", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-58f3-cx8p-h8jg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56327?format=api", "purl": "pkg:composer/drupal/drupal@8.3.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.3.4" } ], "aliases": [ "CVE-2017-6922", "GHSA-58f3-cx8p-h8jg" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-y5mz-1wsc-w3g7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38259?format=api", "vulnerability_id": "VCID-z2xs-z24v-c3e5", "summary": "Denial of service via transliterate mechanism\nA specially crafted URL can cause a denial of service via the transliterate mechanism.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-9452", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59648", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00378", "scoring_system": "epss", "scoring_elements": "0.59698", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-9452" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9452.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9452.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9452.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9452.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9452", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9452" }, { "reference_url": "https://www.drupal.org/SA-CORE-2016-005", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2016-005" }, { "reference_url": "http://www.securityfocus.com/bid/94367", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/94367" }, { "reference_url": "https://security.archlinux.org/ASA-201611-20", "reference_id": "ASA-201611-20", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201611-20" }, { "reference_url": "https://security.archlinux.org/AVG-74", "reference_id": "AVG-74", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-74" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52973?format=api", "purl": "pkg:composer/drupal/drupal@8.2.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2989-fmjz-nkby" }, { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-4pg6-hqge-wkcb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-ah3h-t9qa-gudr" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-ks17-b29e-73au" }, { "vulnerability": "VCID-mm13-6dhq-nqfb" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-nwdx-mgsc-s3f3" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-uvmv-j9kx-jfeq" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-y5mz-1wsc-w3g7" }, { "vulnerability": "VCID-zpeb-7dhc-9kcx" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.2.3" } ], "aliases": [ "CVE-2016-9452", "GHSA-jpj8-49hr-wcwv" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z2xs-z24v-c3e5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40160?format=api", "vulnerability_id": "VCID-zpeb-7dhc-9kcx", "summary": "PECL YAML parser unsafe object handling\nPECL YAML parser does not handle PHP objects safely during certain operations within Drupal core. This can lead to remote code execution.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6920", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.66148", "scoring_system": "epss", "scoring_elements": "0.9854", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.66148", "scoring_system": "epss", "scoring_elements": "0.98537", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6920" }, { "reference_url": "https://github.com/drupal/core", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/drupal/core" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6920.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6920.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6920", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6920" }, { "reference_url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple" }, { "reference_url": "https://www.drupal.org/SA-CORE-2017-003", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.drupal.org/SA-CORE-2017-003" }, { "reference_url": "http://www.securityfocus.com/bid/99211", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/99211" }, { "reference_url": "http://www.securitytracker.com/id/1038781", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id/1038781" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56327?format=api", "purl": "pkg:composer/drupal/drupal@8.3.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-6rtn-zphz-sydn" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7bq1-m8df-k3ba" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-es39-uyu2-myap" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pmmq-8s2m-h7dp" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-r4ja-mndm-uyge" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tbhc-6qre-7kc5" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-w4ks-ufnz-vfav" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" }, { "vulnerability": "VCID-y1nb-prqc-suaj" }, { "vulnerability": "VCID-zqer-y4s4-hqhy" }, { "vulnerability": "VCID-zvtm-9bd5-ufgy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.3.4" } ], "aliases": [ "CVE-2017-6920", "GHSA-9c24-g32g-35rj" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zpeb-7dhc-9kcx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39503?format=api", "vulnerability_id": "VCID-zvtm-9bd5-ufgy", "summary": "XSS Vulnerability\nCKEditor, a third-party JavaScript library included in Drupal core, is affected by a cross-site scripting (XSS) vulnerability. It's possible to execute XSS inside CKEditor when using the `image2` plugin.", "references": [ { "reference_url": "https://www.drupal.org/sa-core-2018-003", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.drupal.org/sa-core-2018-003" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55211?format=api", "purl": "pkg:composer/drupal/drupal@8.4.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/55212?format=api", "purl": "pkg:composer/drupal/drupal@8.5.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2w1s-g91k-xuhj" }, { "vulnerability": "VCID-31qy-vagp-83b6" }, { "vulnerability": "VCID-3dgm-qju3-aqh5" }, { "vulnerability": "VCID-3qrs-sag2-v7g7" }, { "vulnerability": "VCID-3xk4-qwaq-5yaj" }, { "vulnerability": "VCID-4p4c-7rdc-37fa" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-73y5-3fud-9bac" }, { "vulnerability": "VCID-766t-bnd6-ckcb" }, { "vulnerability": "VCID-7n8f-bdkf-sqfu" }, { "vulnerability": "VCID-9nk8-dban-g7h9" }, { "vulnerability": "VCID-a4u4-ga84-wyf9" }, { "vulnerability": "VCID-a7ss-tkb6-gkge" }, { "vulnerability": "VCID-aqxx-kd18-pqgm" }, { "vulnerability": "VCID-ard5-3cjv-1beu" }, { "vulnerability": "VCID-avmn-kqky-83dd" }, { "vulnerability": "VCID-bndv-n7w9-43b4" }, { "vulnerability": "VCID-dnc7-jg8m-8fh3" }, { "vulnerability": "VCID-dyhz-g3nv-yuc3" }, { "vulnerability": "VCID-e69p-v2ws-vufj" }, { "vulnerability": "VCID-e8un-nbkk-cbf9" }, { "vulnerability": "VCID-egtv-y9w1-skgr" }, { "vulnerability": "VCID-eyew-pw17-ryfj" }, { "vulnerability": "VCID-j7bj-atys-qfg3" }, { "vulnerability": "VCID-n318-rcfy-uybg" }, { "vulnerability": "VCID-nacy-y1qt-5yhb" }, { "vulnerability": "VCID-nn8g-m52e-5kfe" }, { "vulnerability": "VCID-pxwv-fhy9-ckfm" }, { "vulnerability": "VCID-rd4g-h1j9-23cb" }, { "vulnerability": "VCID-tbah-jrah-a3fg" }, { "vulnerability": "VCID-tcan-28ga-j3h1" }, { "vulnerability": "VCID-tpzm-u3qp-akc8" }, { "vulnerability": "VCID-vjz6-xgk6-mycf" }, { "vulnerability": "VCID-w3x8-db6e-kued" }, { "vulnerability": "VCID-wsv7-je8g-sqet" }, { "vulnerability": "VCID-wszp-2es5-z7fy" }, { "vulnerability": "VCID-x34m-u169-1bce" }, { "vulnerability": "VCID-xz7z-trbh-j7dk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.2" } ], "aliases": [ "SA-CORE-2018-003" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zvtm-9bd5-ufgy" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.0.0-beta11" }