The AltaGrade Blog

Open ReadSpeaker - Moderately critical - Cross site scripting - SA-CONTRIB-2020-024

Nick Onom's picture

Nick

 Marketing Project Manager

Jun 11, 2020
Add comment

drupal hosting

Project: Open ReadSpeaker
Version: 8.x-1.x-dev
Date: 2020-June-10
Security risk: Moderately critical 13∕25 
Vulnerability: Cross site scripting

Description

This module enables you to add a configured ReadSpeaker button for text-to-speech for your site visitors.

The module doesn't sufficiently sanitize block configuration causing a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Read More

WordPress 5.4.2 has been released

Nick Onom's picture

Nick

 Marketing Project Manager

Jun 11, 2020
Add comment

WordPress hosting

This security and maintenance release features 22 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.

These bugs affect WordPress versions 5.4.1 and earlier; version 5.4.2 fixes them, so you’ll want to upgrade.

If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the bugs for you.

Security Updates

Read More

Services for Drupal 7- Moderately critical - Access bypass - SA-CONTRIB-2020-022

Nick Onom's picture

Nick

 Marketing Project Manager

Jun 3, 2020
Add comment

Services for Drupal 7- Moderately critical - Access bypass - SA-CONTRIB-2020-022

Project: Services
Version: 7.x-3.x-dev
Date: 2020-June-03
Security risk: Moderately critical 11∕25
Vulnerability: Access bypass

Description

This module provides a standardized solution for building API's so that external clients can communicate with Drupal.

The module's taxonomy term index resource doesn't take into consideration certain access control tags provided (but unused) by core, that certain contributed modules depend on.

Read More

Drupal 7.71 has been released today

Nick Onom's picture

Nick

 Marketing Project Manager

Jun 3, 2020
Add comment

Drupal 7.71 has been released today

Drupal 7.71 has been released today on 3 June 2020. This maintenance release of the Drupal 7 series includes bug fixes and small API/feature improvements. It does not have any major, non-backwards-compatible new functionalities. No security fixes are included in this release either.

Read More

Drupal Commerce - Moderately critical - Access bypass - SA-CONTRIB-2020-020

Nick Onom's picture

Nick

 Marketing Project Manager

May 27, 2020
Add comment

Drupal Commerce - Moderately critical - Access bypass - SA-CONTRIB-2020-020

Project: Drupal Commerce
Date: 2020-May-27
Security risk: Moderately critical 12∕25 
Vulnerability: Access bypass

Description

Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never assigned an owner.

Read More

Drupal 7 core - Moderately critical - Open Redirect - SA-CORE-2020-003

Nick Onom's picture

Nick

 Marketing Project Manager

May 20, 2020
Add comment

Drupal 7 core - Moderately critical - Open Redirect - SA-CORE-2020-003

Project: Drupal core
Date: 2020-May-20
Security risk: Moderately critical 10∕25 
Vulnerability: Open Redirect

Description

Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.

The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.

Read More

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

Nick Onom's picture

Nick

 Marketing Project Manager

May 13, 2020
Add comment

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

Project: reCAPTCHA v3
Date: 2020-May-13
Security risk: Critical 18∕25 
Vulnerability: Access bypass

Description

The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3.

If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms.

Read More

Webform - Critical - Access bypass - SA-CONTRIB-2020-018

Nick Onom's picture

Nick

 Marketing Project Manager

May 13, 2020
Add comment

Webform - Critical - Access bypass - SA-CONTRIB-2020-018

Project: Webform
Date: 2020-May-13
Security risk: Critical 15∕25 
Vulnerability: Access bypass

Description

This webform module enables you to build a 'Term checkboxes' element.

The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term checkboxes' element.

Read More

Pages