Drupal core – Critical – Third-party libraries – SA-CORE-2021-001
Project: Drupal coreDate: 2021-January-20Security risk: Critical 18∕25 AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:UncommonVulnerability: Third-party librariesDescription: The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal. For more information please see:
CVE-2020-36193
Exploits may be possible if Drupal is configured to allow .tar, .tar.gz,...
Drupal core – Critical – Arbitrary PHP code execution – SA-CORE-2020-013
Project: Drupal coreDate: 2020-November-25Security risk: Critical 18∕25 AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:UncommonVulnerability: Arbitrary PHP code executionCVE IDs: CVE-2020-28949CVE-2020-28948Description: The Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:
CVE-2020-28948
CVE-2020-28949
Multiple vulnerabilities are possible if Drupal is...
Drupal core – Critical – Remote code execution – SA-CORE-2020-012
Project: Drupal coreDate: 2020-November-18Security risk: Critical 17∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionCVE IDs: CVE-2020-13671Description: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as...
Drupal core – Moderately critical – Information disclosure – SA-CORE-2020-011
Project:
Drupal core
Date:
2020-September-16
Security risk:
Moderately critical 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability:
Information disclosure
CVE IDs:
CVE-2020-13670
Description:
A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing...
Drupal core – Moderately critical – Access bypass – SA-CORE-2020-008
Project:
Drupal core
Date:
2020-September-16
Security risk:
Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability:
Access bypass
CVE IDs:
CVE-2020-13667
Description:
The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace.
The Workspaces module doesn't sufficiently check...
Drupal core – Moderately critical – Cross-site scripting – SA-CORE-2020-010
Project:
Drupal core
Date:
2020-September-16
Security risk:
Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability:
Cross-site scripting
CVE IDs:
CVE-2020-13669
Description:
Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS.
Solution:
Install the latest version:
If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10.
If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6.
If...
Drupal core – Critical – Cross-site scripting – SA-CORE-2020-009
Project:
Drupal core
Date:
2020-September-16
Security risk:
Critical 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability:
Cross-site scripting
CVE IDs:
CVE-2020-13668
Description:
Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances.
An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.
Solution:
Install the...
Drupal core – Moderately critical – Cross-site scripting – SA-CORE-2020-007
Project:
Drupal core
Date:
2020-September-16
Security risk:
Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability:
Cross-site scripting
CVE IDs:
CVE-2020-13666
Description:
The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.
Solution:
Install the latest version:
If you are using Drupal 7.x, upgrade to Drupal 7.73.
If you are using Drupal...
Drupal core – Less critical – Access bypass – SA-CORE-2020-006
Project: Drupal coreDate: 2020-June-17Security risk: Less critical 8∕25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassCVE IDs: CVE-2020-13665 Description: JSON:API PATCH requests may bypass validation for certain fields.
By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the read_only set...
Drupal core – Critical – Arbitrary PHP code execution – SA-CORE-2020-005
Project: Drupal coreDate: 2020-June-17Security risk: Critical 17∕25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Arbitrary PHP code executionCVE IDs: CVE-2020-13664Description: Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances.
An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named...
Drupal core – Critical – Cross Site Request Forgery – SA-CORE-2020-004
Project: Drupal coreDate: 2020-June-17Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13663Description: The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.Solution: If you are using Drupal 7.x, upgrade to Drupal 7.72.
If you...
Drupal core – Moderately critical – Open Redirect – SA-CORE-2020-003
Project: Drupal coreDate: 2020-May-20Security risk: Moderately critical 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Open RedirectDescription: Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by...
Drupal core – Moderately critical – Cross Site Scripting – SA-CORE-2020-002
Project: Drupal coreDate: 2020-May-20Security risk: Moderately critical 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross Site ScriptingDescription: The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are
security issues in...
Drupal core – Moderately critical – Third-party library – SA-CORE-2020-001
Project: Drupal coreVersion: 8.8.x-dev8.7.x-devDate: 2020-March-18Security risk: Moderately critical 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Proof/TD:DefaultVulnerability: Third-party libraryDescription: The Drupal project uses the third-party library CKEditor, which has released a security improvement that is needed to protect some Drupal configurations.
Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor...
Dairy Giant Lactalis Targeted by Hackers
France-based dairy giant Lactalis revealed last week that it was targeted by hackers, but claimed that it had found no evidence of a data breach.
The company said a malicious third party attempted to breach its computer network, but it...
Crypto firm Tether says it won’t pay $24 million ransom after being threatened with document leak
Controversial cryptocurrency developer Tether says it will not give in to extortionists who are demanding a 500 Bitcoin ransom payment (currently worth approximately US $24 million).
Mysterious Macintosh Malware
This is weird:
Once an hour, infected Macs check a control server to see if there are any new commands the malware should run or binaries to execute. So far, however, researchers have yet to observe delivery of any payload...
What Did I Just Read? A Conversation With the Authors of '2034'
Elliot Ackerman and Admiral James Stavridis discuss their inspirations, personal experiences, and what keeps them up at night.
2034, Part VI: Crossing the Red Line
“Eventually, the Americans would find them. But by then it would be too late.”
