article thumbnail

Drupal fixed a new flaw related PEAR Archive_Tar library

Security Affairs

Drupal development team released security updates to address a vulnerability that resides in the PEAR Archive_Tar third-party library. The Drupal development team has released security updates to address the CVE-2020-36193 vulnerability in the PEAR Archive_Tar third-party library. and 7 of the popular CMS. bz2, or.tlz files.

Libraries 115
article thumbnail

Mozilla fixes critical flaw in Network Security Services (NSS) cryptography library

Security Affairs

Mozilla fixed a critical memory corruption issue affecting its cross-platform Network Security Services (NSS) set of cryptography libraries. Mozilla has addressed a heap-based buffer overflow vulnerability (CVE-2021-43527) in its cross-platform Network Security Services (NSS) set of cryptography libraries. ” wrote Ormandy.

Libraries 118
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Experts discovered a privilege escalation issue in popular Umbraco CMS

Security Affairs

Experts discovered a vulnerability in the popular CMS Umbraco that could allow low privileged users to escalate privileges to “admin.” ” Security experts from Trustwave have discovered a privilege escalation vulnerability in the popular website CMS, Umbraco. “Umbraco version 8.9.0 also seen in 8.6.3)

CMS 65
article thumbnail

US CISA added 17 flaws to its Known Exploited Vulnerabilities Catalog

Security Affairs

CVE Number CVE Title Required Action Due Date CVE-2021-32648 October CMS Improper Authentication 2/1/2022 CVE-2021-21315 System Information Library for node.js CVE Number CVE Title Required Action Due Date CVE-2021-32648 October CMS Improper Authentication 2/1/2022 CVE-2021-21315 System Information Library for node.js

CMS 93
article thumbnail

Drupal addressed CVE-2020-13671 Remote Code Execution flaw

Security Affairs

x that fix two XSS vulnerabilities affecting the CKEditor library. In September, Drupal maintainers fixed several information disclosure and cross-site scripting (XSS) vulnerabilities in the popular content management system (CMS). In March, the development team released security updates for versions 8.8.x Pierluigi Paganini.

CMS 107
article thumbnail

CISA adds Log4Shell Log4j flaw to the Known Exploited Vulnerabilities Catalog

Security Affairs

The CVE-2021-44228 flaw made the headlines last week, after Chinese security researcher p0rz9 publicly disclosed a Proof-of-concept exploit for the critical remote code execution zero-day vulnerability ( aka Log4Shell ) that affects the Apache Log4j Java-based logging library.

CMS 94
article thumbnail

Magecart attacks are still around but are more difficult to detect

Security Affairs

Malwarebytes researchers observed the use of 3 different themes by the threat actor to hide their skimmer, named after JavaScript libraries: hal-data[.]org/gre/code.js Malwarebytes researchers observed the use of 3 different themes by the threat actor to hide their skimmer, named after JavaScript libraries: hal-data[.]org/gre/code.js

Cleanup 98