CVE Vulnerability Catalog

Insertion of sensitive information into sent data in Drupal DXPR Builder allows forceful browsing. Affects versions from 0.0.0 to 2.8.1.

Improper neutralization of input during web page generation (Cross-site Scripting) in Drupal Slick Carousel allows stored XSS. Affects versions from 0.0.0 to 2.1.0.

Incorrect authorization in Drupal Entity API allows forceful browsing. Affects versions from 0.0.0 to 1.8.0.

Vulnerability in Drupal Link content parser. The issue affects all versions of the Link content parser.

Vulnerability in Drupal Gammu SMS Daemon. The issue affects all versions of Gammu SMS Daemon.

Vulnerability in Drupal Gammu SMS Daemon. The issue affects all versions of Gammu SMS Daemon.

Vulnerability in Drupal Gammu SMS Daemon. The issue affects all versions of Gammu SMS Daemon.

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. Affects versions from 0.0.0 to 2.0.1 and from 2.1.0 to 2.1.1.

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. Affects versions from 0.0.0 to 4.3.1.

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. Affects versions from 0.0.0 to 2.0.13.

Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. Affects versions from 0.0.0 to 1.1.2.

A Stored XSS vulnerability in the Drupal Entity Browser module is caused by improper neutralization of input during web page generation. Affects versions from 0.0.0 to 2.16.0.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. Affects versions from 0.0.0 to 1.1.4.

Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst from n/a through 2.1.5.

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.

Kimai before version 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.