Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...

DRUPAL-CORE-2019-011

The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations...

Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011

The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations...

PT-2019-20553

The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team reports: A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt. Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with th...

WordPress media-library-assistant plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. media-library-assistant is a multimedia library management plugin used in it. A cross-site scripting vulnerability exists in the...

CVE-2018-20982

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens...

CVE-2018-20982

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens...

CVE-2018-20982

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens...

CVE-2018-20982

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens...

CVE-2018-20982

The CVE concerns the WordPress plugin Media Library Assistant, affected in versions prior to 2.74. The issue is a cross-site scripting (XSS) vulnerability via the Media/Assistant or Settings/Media Library Assistant admin submenu screens, due to the underlying handling in those interfaces. Impact ...

CVE-2018-20982: Improper Neutralization of Input During Web Page Generation

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

Cross site scripting

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

CVE-2019-13493

Sitecore 9.0 rev 171002 is affected by a Persistent XSS in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript. This CVE (CVE-2019-13493) is documented across multiple sources (NVD/Red Hat/CVE listi...

PT-2019-13367

Name of the Vulnerable Software and Affected Versions Sitecore version 9.0 rev 171002 Description The issue exists in the Media Library and File Manager of the affected software, where an authenticated unprivileged user can inject arbitrary JavaScript by modifying the uploaded file extension...

CVE-2019-13493: Improper Neutralization of Input During Web Page Generation

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Date: July 11, 2019 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1...