article thumbnail

Drupal fixed a new flaw related PEAR Archive_Tar library

Security Affairs

Drupal development team released security updates to address a vulnerability that resides in the PEAR Archive_Tar third-party library. The Drupal development team has released security updates to address the CVE-2020-36193 vulnerability in the PEAR Archive_Tar third-party library. and 7 of the popular CMS. bz2, or.tlz files.

Libraries 114
article thumbnail

Experts discovered a privilege escalation issue in popular Umbraco CMS

Security Affairs

Experts discovered a vulnerability in the popular CMS Umbraco that could allow low privileged users to escalate privileges to “admin.” ” Security experts from Trustwave have discovered a privilege escalation vulnerability in the popular website CMS, Umbraco. “Umbraco version 8.9.0 also seen in 8.6.3)

CMS 66
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Mozilla fixes critical flaw in Network Security Services (NSS) cryptography library

Security Affairs

Mozilla fixed a critical memory corruption issue affecting its cross-platform Network Security Services (NSS) set of cryptography libraries. Mozilla has addressed a heap-based buffer overflow vulnerability (CVE-2021-43527) in its cross-platform Network Security Services (NSS) set of cryptography libraries. and NSS 3.73

Libraries 120
article thumbnail

Drupal addressed CVE-2020-13671 Remote Code Execution flaw

Security Affairs

x that fix two XSS vulnerabilities affecting the CKEditor library. In September, Drupal maintainers fixed several information disclosure and cross-site scripting (XSS) vulnerabilities in the popular content management system (CMS). In March, the development team released security updates for versions 8.8.x Pierluigi Paganini.

CMS 108
article thumbnail

US CISA added 17 flaws to its Known Exploited Vulnerabilities Catalog

Security Affairs

CVE Number CVE Title Required Action Due Date CVE-2021-32648 October CMS Improper Authentication 2/1/2022 CVE-2021-21315 System Information Library for node.js CVE Number CVE Title Required Action Due Date CVE-2021-32648 October CMS Improper Authentication 2/1/2022 CVE-2021-21315 System Information Library for node.js

CMS 96
article thumbnail

CISA adds Log4Shell Log4j flaw to the Known Exploited Vulnerabilities Catalog

Security Affairs

The CVE-2021-44228 flaw made the headlines last week, after Chinese security researcher p0rz9 publicly disclosed a Proof-of-concept exploit for the critical remote code execution zero-day vulnerability ( aka Log4Shell ) that affects the Apache Log4j Java-based logging library.

CMS 97
article thumbnail

Drupal fixes 2 critical code execution issues flaws in Drupal 7, 8.5 and 8.6

Security Affairs

The development team marked.phar as a potentially dangerous extension, this means that.phar files uploaded to a website running on the popular CMS will be automatically converted to.txt to prevent malicious execution. The second flaw affects the PEAR Archive_Tar, a third-party library that handles.tar files in PHP. or PHP 5.3.0-5.3.2)

CMS 77