drupal7

5 results · Clear filters · Feed

• High 8.8
  CVE-2020-13671 Exploited Public exploit EPSS 36%

  Drupal core Unrestricted Upload of File with Dangerous Type

  Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

  Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
  Nov 20, 2020

  KEV Jan 18, 2022
• High 7.8
  CVE-2020-28948 Public exploit EPSS 47%

  Multiple vulnerabilities through filename manipulation in Archive_Tar

  Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

  drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist
  Nov 19, 2020
• High 7.8
  CVE-2020-28949 Exploited Public exploit EPSS 85%

  Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

  drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine
  Nov 19, 2020

  KEV Aug 25, 2022
• High 8.8
  CVE-2018-1000888 Public exploit EPSS 19%

  Archive_Tar contains Potential RCE if filename starts with phar://

  PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…

  drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist
  Dec 27, 2018
• High 8.1
  CVE-2018-7602 Exploited · Ransomware Public exploit EPSS 99%

  Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

  A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is relat…

  Drupal Core drupal/core drupal/drupal Ubuntu Alpine Packagist
  Jul 19, 2018

  KEV Apr 13, 2022