Search for packages
Package details: pkg:deb/debian/drupal7@7.52-1~bpo8%2B1
purl pkg:deb/debian/drupal7@7.52-1~bpo8%2B1
Next non-vulnerable version 7.52-2+deb9u11
Latest non-vulnerable version 7.52-2+deb9u11
Risk 10.0
Vulnerabilities affecting this package (18)
Vulnerability Summary Fixed by
VCID-35zf-t4ak-aaae
Aliases:
CVE-2019-11831
GHSA-xv7v-rf6g-xwrc
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-3vvp-6wh9-aaam
Aliases:
CVE-2019-6339
GHSA-8cw5-rv98-5c46
Arbitrary PHP code execution in Drupal
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-4pjz-5ytr-aaag
Aliases:
CVE-2019-6338
GHSA-6rmq-x2hv-vxpp
Vulnerable third party libraries in certain configurations of Symfony
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-539x-pa7r-aaaf
Aliases:
CVE-2018-7600
GHSA-7fh9-933g-885p
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-a9fr-apdt-aaac
Aliases:
DSA-4323-1 drupal7
security update
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-d53w-5nj5-aaaf
Aliases:
CVE-2019-6341
GHSA-cmmh-8mwp-gq5p
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-dwc5-nygz-aaan
Aliases:
CVE-2017-6928
GHSA-66mv-q8r2-hj8w
Incorrect Permission Assignment for Critical Resource When using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-fhgh-jkwa-aaah
Aliases:
CVE-2020-11023
GHSA-jpcq-cgw6-v4j6
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-kkd1-e4k1-aaam
Aliases:
CVE-2020-11022
GHSA-gxr4-xjj5-5px2
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-nmnf-at11-aaag
Aliases:
CVE-2017-6922
GHSA-58f3-cx8p-h8jg
Files uploaded by anonymous users accessed by other users Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core does not provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-rdb7-bn6u-aaaq
Aliases:
CVE-2020-13662
GHSA-gjqg-9rhv-qj67
Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-sdrj-zubv-aaak
Aliases:
CVE-2020-13663
GHSA-m648-hpf8-qcjw
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-sexy-1ad2-aaab
Aliases:
CVE-2017-6927
GHSA-585j-5449-mf5m
JavaScript cross-site scripting prevention is incomplete Drupal has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output is not auto-escaped by either Drupal 7 or Drupal 8). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-snyd-uvt1-aaac
Aliases:
CVE-2017-6929
GHSA-5vpr-v24w-mmjj
Cross-site Scripting A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-t73t-tzz5-aaaa
Aliases:
CVE-2017-6932
GHSA-wm86-w3cf-h6vm
URL Redirection to Untrusted Site (Open Redirect) Drupal core has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-tmu9-vjgy-aaab
Aliases:
CVE-2018-7602
GHSA-297x-j9pm-xjgg
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-tv97-anfg-aaam
Aliases:
CVE-2019-11358
GHSA-6c3j-c64m-qhgq
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
VCID-van2-s7yd-aaap
Aliases:
CVE-2015-7943
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
7.52-2+deb9u11
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-2ynm-8eb8-aaak Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. CVE-2015-6658

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-21T11:08:09.615057+00:00 Debian Oval Importer Affected by VCID-rdb7-bn6u-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T11:03:56.870292+00:00 Debian Oval Importer Affected by VCID-dwc5-nygz-aaan https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T11:02:21.760080+00:00 Debian Oval Importer Affected by VCID-sexy-1ad2-aaab https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T11:01:01.148147+00:00 Debian Oval Importer Affected by VCID-sdrj-zubv-aaak https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:59:21.340910+00:00 Debian Oval Importer Affected by VCID-snyd-uvt1-aaac https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:59:10.052191+00:00 Debian Oval Importer Affected by VCID-539x-pa7r-aaaf https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:57:46.315025+00:00 Debian Oval Importer Affected by VCID-d53w-5nj5-aaaf https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:54:47.135096+00:00 Debian Oval Importer Affected by VCID-tmu9-vjgy-aaab https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:40:37.690734+00:00 Debian Oval Importer Affected by VCID-3vvp-6wh9-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:40:13.493637+00:00 Debian Oval Importer Affected by VCID-tv97-anfg-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:38:29.045559+00:00 Debian Oval Importer Affected by VCID-35zf-t4ak-aaae https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:36:03.279876+00:00 Debian Oval Importer Affected by VCID-4pjz-5ytr-aaag https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:33:16.559295+00:00 Debian Oval Importer Affected by VCID-nmnf-at11-aaag https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:30:13.382477+00:00 Debian Oval Importer Affected by VCID-a9fr-apdt-aaac https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:26:47.111183+00:00 Debian Oval Importer Affected by VCID-kkd1-e4k1-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:24:07.361580+00:00 Debian Oval Importer Affected by VCID-fhgh-jkwa-aaah https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-21T10:15:47.772285+00:00 Debian Oval Importer Affected by VCID-t73t-tzz5-aaaa https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-20T20:14:13.611879+00:00 Debian Oval Importer Affected by VCID-35zf-t4ak-aaae None 36.1.3
2025-06-20T20:13:11.742629+00:00 Debian Oval Importer Affected by VCID-a9fr-apdt-aaac None 36.1.3
2025-06-20T20:12:56.455926+00:00 Debian Oval Importer Affected by VCID-sexy-1ad2-aaab None 36.1.3
2025-06-20T20:10:59.921850+00:00 Debian Oval Importer Affected by VCID-tmu9-vjgy-aaab None 36.1.3
2025-06-20T20:08:34.424138+00:00 Debian Oval Importer Affected by VCID-4pjz-5ytr-aaag None 36.1.3
2025-06-20T20:05:39.756809+00:00 Debian Oval Importer Affected by VCID-sdrj-zubv-aaak None 36.1.3
2025-06-20T20:05:36.995569+00:00 Debian Oval Importer Affected by VCID-van2-s7yd-aaap None 36.1.3
2025-06-20T20:01:32.926898+00:00 Debian Oval Importer Affected by VCID-d53w-5nj5-aaaf None 36.1.3
2025-06-20T19:57:33.384161+00:00 Debian Oval Importer Affected by VCID-539x-pa7r-aaaf None 36.1.3
2025-06-20T19:54:16.654098+00:00 Debian Oval Importer Fixing VCID-2ynm-8eb8-aaak None 36.1.3
2025-06-20T19:53:49.839631+00:00 Debian Oval Importer Affected by VCID-tv97-anfg-aaam None 36.1.3
2025-06-20T19:53:39.696975+00:00 Debian Oval Importer Affected by VCID-kkd1-e4k1-aaam None 36.1.3
2025-06-08T04:36:47.111493+00:00 Debian Oval Importer Affected by VCID-rdb7-bn6u-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:34:02.833929+00:00 Debian Oval Importer Affected by VCID-dwc5-nygz-aaan https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:33:08.948230+00:00 Debian Oval Importer Affected by VCID-sexy-1ad2-aaab https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:32:50.292827+00:00 Debian Oval Importer Affected by VCID-sdrj-zubv-aaak https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:31:49.915053+00:00 Debian Oval Importer Affected by VCID-snyd-uvt1-aaac https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:31:43.680820+00:00 Debian Oval Importer Affected by VCID-539x-pa7r-aaaf https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:30:45.426417+00:00 Debian Oval Importer Affected by VCID-d53w-5nj5-aaaf https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:28:57.977503+00:00 Debian Oval Importer Affected by VCID-tmu9-vjgy-aaab https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:20:22.804336+00:00 Debian Oval Importer Affected by VCID-3vvp-6wh9-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:19:56.205579+00:00 Debian Oval Importer Affected by VCID-tv97-anfg-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:18:55.950120+00:00 Debian Oval Importer Affected by VCID-35zf-t4ak-aaae https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:17:38.077163+00:00 Debian Oval Importer Affected by VCID-4pjz-5ytr-aaag https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:15:51.606152+00:00 Debian Oval Importer Affected by VCID-nmnf-at11-aaag https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:14:07.377887+00:00 Debian Oval Importer Affected by VCID-a9fr-apdt-aaac https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:11:48.190677+00:00 Debian Oval Importer Affected by VCID-kkd1-e4k1-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:10:02.512727+00:00 Debian Oval Importer Affected by VCID-fhgh-jkwa-aaah https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-08T04:03:57.683761+00:00 Debian Oval Importer Affected by VCID-t73t-tzz5-aaaa https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-07T13:55:13.947355+00:00 Debian Oval Importer Affected by VCID-35zf-t4ak-aaae None 36.1.0
2025-06-07T13:54:36.510733+00:00 Debian Oval Importer Affected by VCID-a9fr-apdt-aaac None 36.1.0
2025-06-07T13:54:23.966761+00:00 Debian Oval Importer Affected by VCID-sexy-1ad2-aaab None 36.1.0
2025-06-07T13:54:00.633144+00:00 Debian Oval Importer Affected by VCID-tmu9-vjgy-aaab None 36.1.0
2025-06-07T13:53:24.162300+00:00 Debian Oval Importer Affected by VCID-4pjz-5ytr-aaag None 36.1.0
2025-06-07T13:52:04.626029+00:00 Debian Oval Importer Affected by VCID-sdrj-zubv-aaak None 36.1.0
2025-06-07T13:52:03.259097+00:00 Debian Oval Importer Affected by VCID-van2-s7yd-aaap None 36.1.0
2025-06-07T13:50:20.605469+00:00 Debian Oval Importer Affected by VCID-d53w-5nj5-aaaf None 36.1.0
2025-06-07T13:47:13.536697+00:00 Debian Oval Importer Affected by VCID-539x-pa7r-aaaf None 36.1.0
2025-06-07T13:45:05.281476+00:00 Debian Oval Importer Fixing VCID-2ynm-8eb8-aaak None 36.1.0
2025-06-07T13:44:37.372216+00:00 Debian Oval Importer Affected by VCID-tv97-anfg-aaam None 36.1.0
2025-06-07T13:44:27.462178+00:00 Debian Oval Importer Affected by VCID-kkd1-e4k1-aaam None 36.1.0
2025-04-08T03:07:35.801550+00:00 Debian Oval Importer Affected by VCID-rdb7-bn6u-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T03:04:34.398346+00:00 Debian Oval Importer Affected by VCID-dwc5-nygz-aaan https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T03:03:37.758198+00:00 Debian Oval Importer Affected by VCID-sexy-1ad2-aaab https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T03:03:17.740043+00:00 Debian Oval Importer Affected by VCID-sdrj-zubv-aaak https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T03:02:13.552927+00:00 Debian Oval Importer Affected by VCID-snyd-uvt1-aaac https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T03:02:06.997879+00:00 Debian Oval Importer Affected by VCID-539x-pa7r-aaaf https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T03:01:06.985193+00:00 Debian Oval Importer Affected by VCID-d53w-5nj5-aaaf https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:59:09.471486+00:00 Debian Oval Importer Affected by VCID-tmu9-vjgy-aaab https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:49:52.550094+00:00 Debian Oval Importer Affected by VCID-3vvp-6wh9-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:49:27.332299+00:00 Debian Oval Importer Affected by VCID-tv97-anfg-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:48:22.160812+00:00 Debian Oval Importer Affected by VCID-35zf-t4ak-aaae https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:46:59.606093+00:00 Debian Oval Importer Affected by VCID-4pjz-5ytr-aaag https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:45:08.569088+00:00 Debian Oval Importer Affected by VCID-nmnf-at11-aaag https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:43:17.049115+00:00 Debian Oval Importer Affected by VCID-a9fr-apdt-aaac https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:40:48.046256+00:00 Debian Oval Importer Affected by VCID-kkd1-e4k1-aaam https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:38:54.300940+00:00 Debian Oval Importer Affected by VCID-fhgh-jkwa-aaah https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-08T02:32:22.366056+00:00 Debian Oval Importer Affected by VCID-t73t-tzz5-aaaa https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-07T12:30:00.303923+00:00 Debian Oval Importer Affected by VCID-35zf-t4ak-aaae None 36.0.0
2025-04-07T12:29:23.955822+00:00 Debian Oval Importer Affected by VCID-a9fr-apdt-aaac None 36.0.0
2025-04-07T12:29:11.563273+00:00 Debian Oval Importer Affected by VCID-sexy-1ad2-aaab None 36.0.0
2025-04-07T12:28:49.153029+00:00 Debian Oval Importer Affected by VCID-tmu9-vjgy-aaab None 36.0.0
2025-04-07T12:28:15.734832+00:00 Debian Oval Importer Affected by VCID-4pjz-5ytr-aaag None 36.0.0
2025-04-07T12:26:59.419027+00:00 Debian Oval Importer Affected by VCID-sdrj-zubv-aaak None 36.0.0
2025-04-07T12:26:57.941612+00:00 Debian Oval Importer Affected by VCID-van2-s7yd-aaap None 36.0.0
2025-04-07T12:25:17.165268+00:00 Debian Oval Importer Affected by VCID-d53w-5nj5-aaaf None 36.0.0
2025-04-07T12:22:19.234391+00:00 Debian Oval Importer Affected by VCID-539x-pa7r-aaaf None 36.0.0
2025-04-07T12:20:20.369331+00:00 Debian Oval Importer Fixing VCID-2ynm-8eb8-aaak None 36.0.0
2025-04-07T12:19:52.895319+00:00 Debian Oval Importer Affected by VCID-tv97-anfg-aaam None 36.0.0
2025-04-07T12:19:42.295359+00:00 Debian Oval Importer Affected by VCID-kkd1-e4k1-aaam None 36.0.0