Latest security news
Page 2
Thu, March 17
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005
Project: Drupal core Project machine name: drupal Date: 2022-March-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8 CVE IDs: CVE-2022-24728 CVE-2022-24729 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (e…
Thu, February 17
Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004
Project: Drupal core Project machine name: drupal Date: 2022-February-16 Security risk: Moderately critical 12 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: >= 8.0.0 <9.2.13 || >= 9.3.0 <9.3.6 CVE IDs: CVE-2022-25270 Description: The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard pr…