https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 02:09:35 +0000 https://db.gcve.eu/vuln/drupal-contrib-2026-290 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/oauth2_token_manager</p> <p>This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback.</p> <p>The module doesn&#39;t restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site&#39;s integration to an account they control.</p> <p>This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/oauth2_token_manager</p> <p>This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback.</p> <p>The module doesn&#39;t restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site&#39;s integration to an account they control.</p> <p>This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).</p> https://db.gcve.eu/vuln/drupal-contrib-2026-290 https://db.gcve.eu/vuln/fkie_cve-2026-118573 <p>Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.</p> <p>Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118573 https://db.gcve.eu/vuln/ghsa-72vv-q34x-gffg <p>Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.</p> <p>Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.</p> https://db.gcve.eu/vuln/ghsa-72vv-q34x-gffg https://db.gcve.eu/vuln/wid-sec-w-2026-4230 <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4230