Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: Drupal core — DSA-4370 Clear all filters
TI-2019-04504 CVE-2019-6339 · GHSA-8cw5-rv98-5c46

PHAR stream wrapper Arbitrary PHP code execution

Priority HIGH 68

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.3595 Published 2019-01-22 Fixed in 7.62, 8.6.6. +3 CWE-20
TI-2019-04503 CVE-2019-6338 · GHSA-6rmq-x2hv-vxpp

third-party PEAR Archive_Tar library updates

Priority LOW 39

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library.

CVSS 3.0HIGH 8.0 Network Low privileges User interaction EPSS 0.0212 Published 2019-01-22 Fixed in 7.62, 8.6.6. +3 CWE-502