Search for packages
| purl | pkg:composer/drupal/core@8.6.0-alpha1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-163u-tpj9-skc5
Aliases: GMS-2019-147 |
Cross-site Scripting vulnerability in drupal. |
Affected by 4 other vulnerabilities. |
|
VCID-1jfe-j1fz-juec
Aliases: GMS-2018-54 |
URL Redirection to Untrusted Site ('Open Redirect') Anonymous Open Redirect in drupal. |
Affected by 7 other vulnerabilities. |
|
VCID-757r-nv73-gfhg
Aliases: GMS-2018-55 |
Code Injection Injection in `DefaultMailSystem::mail()`. |
Affected by 7 other vulnerabilities. |
|
VCID-7qhc-n6hc-ukbu
Aliases: CVE-2019-11831 GHSA-xv7v-rf6g-xwrc |
Moderately critical - Third-party libraries - SA-CORE-2019-007 The `PharStreamWrapper` (aka `phar-stream-wrapper`) package does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a `phar:///path/bad.phar/../good.phar` URL. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-j545-f44v-w3cn
Aliases: CVE-2019-6339 GHSA-8cw5-rv98-5c46 |
Improper Input Validation A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted `phar://` URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration. |
Affected by 5 other vulnerabilities. |
|
VCID-nfzm-eyht-kkb1
Aliases: GMS-2018-52 |
Improper Access Control in drupal. |
Affected by 7 other vulnerabilities. |
|
VCID-re2h-u5bk-wqbw
Aliases: GMS-2018-53 |
URL Redirection to Untrusted Site ('Open Redirect') External URL injection through URL aliases in drupal. |
Affected by 7 other vulnerabilities. |
|
VCID-vby4-6r8z-6qgy
Aliases: GMS-2018-56 |
Improper Access Control In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass. |
Affected by 7 other vulnerabilities. |
|
VCID-yy7m-f66v-fbhz
Aliases: CVE-2019-6338 GHSA-6rmq-x2hv-vxpp |
Deserialization of Untrusted Data Drupal core uses the third-party PEAR `Archive_Tar` library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details. |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||