Batches of security advisories were rolled out by Drupal, Google and Cisco yesterday addressing a host of critical-rated issues for their products.

Drupal addressed a critical
vulnerability affecting Drupal 8.7 and 8.8. The issue is a Cross Site Scripting
vulnerability in third-party libraries. An attacker that can create or edit
content may be able to exploit this Cross Site Scripting vulnerability to
target users with access to the WYSIWYG CKEditor, and this may include site
admins with privileged access.

The
organization recommends updating to versions 8.7.12 and 8.8.4, respectively, to
obtain the proper patches. If updating is not possible it is suggested to
disable the CKEditor module until the update can be accomplished.

Cisco
fixed six vulnerabilities in its Cisco SD-WAN cloud scale architecture. The
three rated, which are all due to insufficient input validation as potentially
having a high impact are:

• CVE-2020-3265 is a solution privilege
  escalation could allow an authenticated, local attacker to elevate privileges
  to root on the underlying operating system.
• CVE-2020-3265 is a solution command injection
  vulnerability that if exploited could let a local attacker inject arbitrary commands
  with root privileges.
• CVE-2020-3264 can be exploited by sending
  specially crafted traffic to an affected device giving the attacker access to
  information and allowing this person to make changes to the system that they
  are not authorized to make.

Google
issued 13 updates, all rated high, to its Chome Stable Channel with many
focusing on use after free issues.

Four,
CVE-2020-6449, CVE-2020-6429, CVE-2020-6428
and CVE-2020-6427 centered use after free audio flaw. CVE-2020-6422 and CVE-2020-6424
were use after free WebGL and use after free media.