CVE-2024-13291

Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Basic Http Authentication Project

Products

Basic Http Authentication

CVE-2024-2859

By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)

By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Sannav

CVE-2024-13292

Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tooltip Project

Products

Tooltip

CVE-2024-13293

POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Post File Project

Products

Post File

CVE-2024-13294

POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Post File Project

Products

Post File

CVE-2024-13295

Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Node Export Project

Products

Node Export

CVE-2024-13298

Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kleegroup

Products

Tarte Au Citron

CVE-2024-13299

Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Boozallen

Products

Megamenu Framework

CVE-2024-32878

Use of Uninitialized Variable Vulnerability in llama.cpp

Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerability has been patched in commit b2740.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ggerganov Ggml

Products

Llama.cpp Llama.cpp

CVE-2024-13300

Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066

Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Print Anything Project

Products

Print Anything

CVE-2024-13301

OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Oauth \& Openid Connect Single Sign-on

CVE-2024-13302

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ciandt

Products

Pages Restriction Access

CVE-2024-13303

Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Download All Files Project

Products

Download All Files

CVE-2024-13310

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Git Utilities Project

Products

Git Utilities

CVE-2024-13311

Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Allow All File Extensions For File Fields Project

Products

Allow All File Extensions For File Fields

CVE-2024-13275

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Security Kit Project

Products

Security Kit

CVE-2024-13276

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

File Entity Project

Products

File Entity

CVE-2024-13277

Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Smart Ip Ban Project

Products

Smart Ip Ban

CVE-2024-13278

Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Diff Project

Products

Diff

CVE-2024-13279

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Two-factor Authentication Project

Products

Two-factor Authentication