CVE Vulnerability Catalog

The Leaflet module for Drupal contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 10.4.13.

The Inline Formatter Field module for Drupal contains a vulnerability involving improper neutralization of special elements used in a template engine, allowing code injection. This issue affects versions from 0.0.0 to 4.2.0.

The Gutenberg module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 2.15.0 and from 3.0.0 to 3.0.7.

A Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Advanced Filesystem module allows an attacker to force unwanted actions on behalf of a logged-in user. This issue affects versions from 0.0.0 to 1.0.28.

An authentication bypass using an alternate path or channel in the Drupal Authenticator Login Plus (2FA) module allows bypassing the login mechanism. This issue affects versions from 0.0.0 to 1.0.1.

An improper neutralization of special elements used in a template engine vulnerability in the Drupal Linked Field module allows code injection. This issue affects versions from 0.0.0 to 1.8.0.

An incorrect authorization vulnerability in the Drupal Inline Entity Form Dialog module allows forceful browsing. This issue affects versions from 0.0.0 to 1.0.6.

An incorrect authorization vulnerability in the Drupal Actstream module allows forceful browsing. This issue affects versions from 0.0.0 to 2.0.1 and from 2.1.0 to 2.1.1.

The Authenticator Login Plus (2FA) module for Drupal allows authentication bypass using an alternate path or channel. This affects versions from 0.0.0 to 1.0.1.

A vulnerability was found in the Orphans Media module for Drupal, with details not provided in the description. This affects all versions of the module (*.*).

The MathJax: LaTeX for Drupal module does not properly neutralize input during web page generation, enabling cross-site scripting (XSS). This affects versions from 0.0.0 to 4.1.2.

The Entity Reference Manager (Merge entities) module for Drupal contains an incorrect authorization vulnerability enabling forceful browsing. This affects versions from 0.0.0 to 1.0.3.

A vulnerability was found in the ECA Helper module for Drupal, with details not provided in the description. This affects all versions of the module (*.*).

A flaw in the ChunkReader component of the Undertow web server mishandles chunk size validation for chunked transfer encoding. The size check occurs before the value is shifted, allowing a crafted 15-digit chunk size to bypass the limit and overflow internal state flags.

Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page.

Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page.

A flaw was found in the required action provider mechanism of Keycloak. When an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user (such as profile verification or terms and conditions), Keycloak may skip these mandatory challenges and issue an authorization code.

A flaw was found in the UMA resource registration endpoint of the keycloak-services component. When remote resource management is enabled, an authenticated user with specific permissions can update resources they do not own by providing a target resource ID in a request.

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or a document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow.