Known Vulnerabilities for products from Acquia
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Acquia".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2022-25772 json | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to in... | 6.1 - MEDIUM | 2022-06-20 | 2023-05-09 |
| CVE-2021-27914 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 4.8 - MEDIUM | 2022-06-01 | 2022-06-08 |
| CVE-2021-27913 json | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being on... | 3.5 - LOW | 2021-08-30 | 2021-09-03 |
| CVE-2021-27912 json | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline J... | 5.4 - MEDIUM | 2021-08-30 | 2021-09-03 |
| CVE-2021-27911 json | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and tri... | 6.1 - MEDIUM | 2021-08-30 | 2021-09-10 |
| CVE-2021-27910 json | Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callbac... | 6.1 - MEDIUM | 2021-08-30 | 2021-09-10 |
| CVE-2021-27909 json | For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable pa... | 6.1 - MEDIUM | 2021-08-30 | 2021-09-10 |
| CVE-2021-27908 json | In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authori... | 4.4 - MEDIUM | 2021-03-23 | 2022-07-29 |
| CVE-2020-35128 json | Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could... | 9 - CRITICAL | 2021-01-19 | 2021-02-24 |
| CVE-2020-35125 json | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject ex... | 9.6 - CRITICAL | 2021-02-09 | 2021-02-16 |
| CVE-2020-35124 json | A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject e... | 9.6 - CRITICAL | 2021-01-28 | 2021-02-05 |
| CVE-2018-11200 json | An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field. | 6.1 - MEDIUM | 2019-09-20 | 2019-09-23 |
| CVE-2018-11198 json | An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json. | 6.1 - MEDIUM | 2019-09-06 | 2021-01-25 |
| CVE-2017-1000490 json | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to ... | 6.5 - MEDIUM | 2018-01-03 | 2021-01-25 |
| CVE-2017-1000489 json | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address | 8.1 - HIGH | 2018-01-03 | 2021-01-25 |
| CVE-2017-1000488 json | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using... | 6.1 - MEDIUM | 2018-01-03 | 2021-01-25 |
| CVE-2017-8874 json | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authenticatio... | Not Provided | 2017-05-10 | 2025-04-20 |
| CVE-2015-8754 json | The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modif... | Not Provided | 2016-01-08 | 2026-05-06 |
| CVE-2013-1908 json | The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict ... | Not Provided | 2013-07-16 | 2026-04-29 |
| CVE-2013-1907 json | The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict ... | Not Provided | 2013-07-16 | 2026-04-29 |