Date: Wednesday, Nov 18th, 2020
Security risk: Critical
Advisory ID: BACKDROP-SA-CORE-2020-007
CVE ID: CVE-2020-13671
Vulnerability: Remote Code ExecutionBackdrop versions 1.15 and prior do not receive security coverage.
Project: Media: oEmbed
Date: 2020-November-18
Security risk: Critical 17∕25
Vulnerability: Remote Code ExecutionMedia oEmbed does not properly sanitize certain filenames as described in SA-CORE-2020-012.
Install the latest version:
Upgrade to Media oEmbed 7.x-2.8
Project: Drupal OAuth Server ( OAuth Provider) - Single Sign On ( SSO )
Date: 2020-October-14
Vulnerability: SQL Injection
This module enables you login into any OAuth 2.0 compliant application using Drupal credentials.
The 8.x branch of the module is vulnerable to SQL injection.
Install the latest version:
If you use the Drupal OAuth Server module for Drupal 8.x, upgrade to 8.x-1.1
Project: Drupal core
Date: 2020-September-16
Security risk: Moderately critical 14∕25
Vulnerability: Cross-site scripting
CVE IDs: CVE-2020-13666The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.
Install the latest version:
This maintenance release features 34 bug fixes, 5 enhancements, and 5 bug fixes for the block editor. These bugs affect WordPress version 5.5, so you’ll want to upgrade.
A new version of WordPress named “Eckstine” has been released today. Named “Eckstine” in honor of Billy Eckstine, this latest and greatest version of WordPress is available for download or update in your dashboard.
Posts and pages feel faster, thanks to lazy-loaded images.
Images give your story a lot of impact, but they can sometimes make your site seem slow.
In WordPress 5.5, images wait to load until they’re just about to scroll into view. The technical term is ‘lazy loading.’
Project: Apigee Edge
Version: 8.x-1.x-dev
Date: 2020-July-22
Security risk: Moderately critical 10∕25
Vulnerability: Access bypassThe Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. It contains an "Apigee Edge Teams" submodule that provides shared app functionality by allowing developers to be organized into teams.
Project: Modal Form
Version: 8.x-1.x-dev
Date: 2020-July-22
Security risk: Critical 16∕25
Vulnerability: Access bypassThe Modal form module is a toolset for quick start of using forms in modal windows.
Any form is available for view and submit when the modal_form module is installed. The only requirement is to know the form's fully-qualified class name.
Upgrade to modal_form-8.x-1.2.
Project: Easy Breadcrumb
Version: 8.x-1.x-dev
Date: 2020-July-22
Security risk: Moderately critical 13∕25
Vulnerability: Cross site scriptingThis module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.
The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.