Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2014-056 - Commerce Moneris - Information Disclosure

By Drupal Security Team on 21 May 2014 at 15:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-056
Project: Commerce Moneris (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-055 - Require Login - Access bypass

By Drupal Security Team on 21 May 2014 at 15:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-055
Project: Require Login (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-054 - Views - Access Bypass

By Drupal Security Team on 21 May 2014 at 14:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-054
Project: Views (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-053 - Field API Tab Editor (FATE) - Access bypass

By Drupal Security Team on 14 May 2014 at 16:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-053
Project: Field API Tab Editor (third-party module)
Version: 7.x
Date: 2014-May-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-052 - AddressField Tokens - Cross Site Scripting (XSS)

By Drupal Security Team on 14 May 2014 at 15:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-052
Project: Addressfield Tokens (third-party module)
Version: 7.x
Date: 2014-May-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-051 - Realname Registration - Information Disclosure

By Drupal Security Team on 14 May 2014 at 15:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-051
Project: Realname registration (third-party module)
Version: 6.x, 7.x
Date: 2014-05-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-050 - Commerce Postfinance ePayment - Access Bypass

By Drupal Security Team on 14 May 2014 at 13:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-050
Project: Commerce Postfinance ePayment (third-party module)
Version: 7.x
Date: 2014-May-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-049 - Organic Groups (OG) - Access Bypass

By Drupal Security Team on 7 May 2014 at 18:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-049
Project: Organic groups (third-party module)
Version: 7.x
Date: 2014-May-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-048 - Field API Pane Editor (FAPE) - Access bypass

By Drupal Security Team on 30 Apr 2014 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-048
Project: Field API Pane Editor (FAPE) (third-party module)
Version: 7.x
Date: 2014-April-30
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-047 - Zen - Cross Site Scripting

By Drupal Security Team on 30 Apr 2014 at 15:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-047
Project: Zen (third-party theme)
Version: 7.x
Date: 2014-April-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-046 - Context Form Alteration - Cross Site Scripting (XSS)

By Drupal Security Team on 30 Apr 2014 at 13:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-046
Project: Context Form Alteration (third-party module)
Version: 7.x
Date: 2014-April-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-045 - Drupal Commons - Multiple Vulnerabilities

By Drupal Security Team on 23 Apr 2014 at 18:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-045
Project: Drupal Commons (third-party module)
Version: 7.x
Date: 2014-April-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-044 - Professional Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Apr 2014 at 17:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-044
Project: Professional Theme (third-party module)
Version: 7.x
Date: 2014-April-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-043 - Custom Search - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Apr 2014 at 15:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-043
Project: Custom Search (third-party module)
Version: 6.x, 7.x
Date: 2014-April-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-042 - Internationalization - Access Bypass

By Drupal Security Team on 23 Apr 2014 at 15:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-042
Project: Internationalization (third-party module)
Version: 7.x
Date: 2014-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2014-002 - Drupal core - Information Disclosure

By Drupal Security Team on 16 Apr 2014 at 19:50 UTC

Advisory ID: DRUPAL-SA-CORE-2014-002
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-April-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-041 - Block Search - SQL Injection

By Drupal Security Team on 16 Apr 2014 at 15:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-041
Project: Block Search (third-party module)
Version: 6.x
Date: 2014-April-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2014-040 - Skeleton theme - Cross Site Scripting

By Drupal Security Team on 9 Apr 2014 at 14:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-040
Project: Skeleton (third-party theme)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-038 - SimpleCorp theme - Cross Site Scripting

By Drupal Security Team on 9 Apr 2014 at 14:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-038
Project: SimpleCorp (third-party theme)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-039 - Revisioning - Access Bypass

By Drupal Security Team on 9 Apr 2014 at 14:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-039
Project: Revisioning (third-party module)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-037 - BlueMasters - Cross Site Scripting

By Drupal Security Team on 9 Apr 2014 at 14:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-037
Project: BlueMasters (third-party module)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-036 - Print - Cross Site Scripting

By Drupal Security Team on 2 Apr 2014 at 17:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-036
Project: Printer, email and PDF versions (third-party module)
Version: 6.x, 7.x
Date: 2014-April-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-035 - CAS Server - Access Bypass

By Drupal Security Team on 2 Apr 2014 at 17:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-035
Project: CAS (third-party module)
Version: 6.x, 7.x
Date: 2014-April-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-034 - Custom Search - Cross Site Scripting

By Drupal Security Team on 2 Apr 2014 at 17:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-034
Project: Custom Search (third-party module)
Version: 6.x, 7.x
Date: 2014-April-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-033 - Nivo Slider - Cross Site Scripting

By Drupal Security Team on 19 Mar 2014 at 17:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-033
Project: Nivo Slider (third-party module)
Version: 7.x
Date: 2014-March-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-032 - Xapian integration - Access Bypass

By Drupal Security Team on 19 Mar 2014 at 16:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-032
Project: Xapian integration (third-party module)
Version: 6.x, 7.x
Date: 2014-March-19
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-031 - Webform Template - Access Bypass

By Drupal Security Team on 12 Mar 2014 at 20:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-031
Project: Webform Template (third-party module)
Version: 7.x
Date: 2014-March-12
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2014-030 - SexyBookmarks - Information Disclosure

By Drupal Security Team on 12 Mar 2014 at 14:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-030
Project: SexyBookmarks (third-party module)
Version: 6.x
Date: 2014-March-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-029 - Mime Mail - Access Bypass

By Drupal Security Team on 5 Mar 2014 at 17:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-029
Project: Mime Mail (third-party module)
Version: 6.x, 7.x
Date: 2014-March-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-028 - Masquerade - Access bypass

By Drupal Security Team on 5 Mar 2014 at 17:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-028
Project: Masquerade (third-party module)
Version: 6.x, 7.x
Date: 2014-March-05
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-027 - NewsFlash Theme - XSS

By Drupal Security Team on 5 Mar 2014 at 17:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-027
Project: NewsFlash (third-party theme)
Version: 6.x, 7.x
Date: 2014-March-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-026 - Mime Mail - Access bypass

By Drupal Security Team on 26 Feb 2014 at 19:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-026
Project: Mime Mail (third-party module)
Version: 6.x, 7.x
Date: 2014-February-26
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-025 - Open Omega - Access Bypass

By Drupal Security Team on 26 Feb 2014 at 17:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-025
Project: Open Omega (third-party theme)
Version: 7.x
Date: 2014-February-26
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-024 - Content Lock - CSRF

By Drupal Security Team on 26 Feb 2014 at 16:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-024
Project: Content locking (anti-concurrent editing) (third-party module)
Version: 6.x, 7.x
Date: 2014-February-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2014-023 - Project Issue File Review - XSS

By Drupal Security Team on 26 Feb 2014 at 16:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-023
Project: Project Issue File Review (third-party module)
Version: 6.x
Date: 2014-February-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-022 - Slickgrid - Access bypass

By Drupal Security Team on 19 Feb 2014 at 15:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-022
Project: Slickgrid (third-party module)
Version: 7.x
Date: 2014-February -22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-021 - Maestro - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Feb 2014 at 14:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-021
Project: Maestro (third-party module)
Version: 7.x
Date: 2014-February-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-020 - Drupal Commons - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 21:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-020
Project: Drupal Commons (third-party distribution)
Version: 7.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-019 - Easy Social - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 19:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-019
Project: Easy Social (third-party module)
Version: 7.x
Date: 2014-February-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-018 - Webform - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 16:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-018
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2014-February-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-017- Image Resize Filter - Denial of Service (DOS)

By Drupal Security Team on 12 Feb 2014 at 16:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-017
Project: Image Resize Filter (third-party module)
Version: 6.x, 7.x
Date: 2014-February-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Denial of Service (DOS)

SA-CONTRIB-2014-016 - Mayo Theme - XSS Vulnerability

By Drupal Security Team on 12 Feb 2014 at 16:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-016
Project: MAYO (third-party theme)
Version: 7.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-015 - FileField - Access Bypass

By Drupal Security Team on 12 Feb 2014 at 16:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-015
Project: FileField (third-party module)
Version: 6.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-014 - Webform Validation - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 16:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-014
Project: Webform Validation (third-party module)
Version: 6.x, 7.x
Date: 2014-February-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-013- Chaos tool suite (ctools) - Access Bypass

By Drupal Security Team on 12 Feb 2014 at 15:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-013
Project: Chaos tool suite (ctools) (third-party module)
Version: 6.x, 7.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-012- Modal Frame API - Cross Site Scripting (XSS)

By Drupal Security Team on 5 Feb 2014 at 21:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-012
Project: Modal Frame API (third-party module)
Version: 6.x
Date: 2014-February-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-011 - Push Notifications - Information Disclosure

By Drupal Security Team on 5 Feb 2014 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-011
Project: Push Notifications (third-party module)
Version: 7.x
Date: 2014-February-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-010 - Services - Access Bypass and Privilege Escalation

By Drupal Security Team on 5 Feb 2014 at 15:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-010
Project: Services (third-party module)
Version: 7.x
Date: 2014-February-05
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-009 - Tagadelic - Information Disclosure

By Drupal Security Team on 3 Feb 2014 at 02:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-009
Project: Tagadelic (third-party module)
Version: 6.x
Date: 2014-February-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-008 - Tribune - Cross Site Scripting (XSS)

By Drupal Security Team on 29 Jan 2014 at 21:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-008
Project: Tribune (third-party module)
Version: 6.x, 7.x
Date: 2014-January-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS