Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2012-026 - ZipCart - Access bypass

By Drupal Security Team on 29 Feb 2012 at 14:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-026
Project: ZipCart (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-025 - Cool aid; Editable help messages - Multiple vulnerabilities

By Drupal Security Team on 29 Feb 2012 at 14:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-025
Project: Cool aid; Editable help messages (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting

SA-CONTRIB-2012-024 - MediaFront - Cross Site Scripting

By Drupal Security Team on 29 Feb 2012 at 13:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-024
Project: MediaFront (third-party module)
Version: 6.x, 7.x
Date: 2012-February-29
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-023 - FAQ - Cross Site Scripting

By Drupal Security Team on 22 Feb 2012 at 22:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-023
Project: Frequently Asked Questions (third-party module)
Version: 6.x
Date: 2012-February-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-022 - CDN - Information disclosure

By Drupal Security Team on 15 Feb 2012 at 20:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-022
Project: CDN (third-party module)
Version: 6.x, 7.x
Date: 2012-February-15
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-021 - Organic Groups Vocab Access Bypass

By Drupal Security Team on 15 Feb 2012 at 20:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-021
Project: Organic Groups Vocabulary (third-party module)
Version: 6.x
Date: 2012-February-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-020 - Faster Permissions - Access bypass

By Drupal Security Team on 15 Feb 2012 at 20:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-020
Project: Faster Permissions (third-party module)
Version: 7.x
Date: 2012-February-15
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-019 - Link checker - Access bypass

By Drupal Security Team on 15 Feb 2012 at 17:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-019
Project: Link checker (third-party module)
Version: 6.x
Date: 2012-February-15
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-018 - Revisioning - Cross Site Scripting

By Drupal Security Team on 9 Feb 2012 at 00:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-018
Project: Revisioning (third-party module)
Version: 6.x
Date: 2012-FEB-08
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-017 - Finder - Multiple vulnerabilities

By Drupal Security Team on 8 Feb 2012 at 16:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-017
Project: Finder (third-party module)
Version: 6.x, 7.x
Date: 2012-February-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Arbitrary PHP code execution, Multiple vulnerabilities

SA-CONTRIB-2012-016 - Forward module CSRF and Access bypass

By Drupal Security Team on 1 Feb 2012 at 22:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-016
Project: Forward (third-party module)
Version: 6.x, 7.x
Date: 2012-February-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Request Forgery

SA-CORE-2012-001 - Drupal core multiple vulnerabilities

By Drupal Security Team on 1 Feb 2012 at 22:06 UTC

Advisory ID: DRUPAL-SA-CORE-2012-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2012-February-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Request Forgery, Multiple vulnerabilities

SA-CONTRIB-2012-015 - Managesite - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Jan 2012 at 21:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-015
Project: Managesite (third-party module)
Version: 6.x
Date: 2012-January-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-014 - Drupal Commerce - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Jan 2012 at 19:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-014
Project: Drupal Commerce (third-party module)
Version: 7.x
Date: 2012-January-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-013 - Search Autocomplete - SQL Injection

By Drupal Security Team on 25 Jan 2012 at 16:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-013
Project: Search Autocomplete (third-party module)
Version: 7.x
Date: 2012-January-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2012-012 - Quicktabs - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jan 2012 at 20:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-012
Project: Quick Tabs (third-party module)
Version: 6.x, 7.x
Date: 2012-January-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-011 - Panels - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jan 2012 at 19:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-011
Project: Panels (third-party module)
Version: 6.x
Date: 2012-January-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-010 - stickynote - Multiple vulnerabilities

By Drupal Security Team on 18 Jan 2012 at 19:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-010
Project: stickynote (third-party module)
Version: 7.x
Date: 2012-January-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-009 - Revisioning - Access bypass

By Drupal Security Team on 18 Jan 2012 at 17:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-009
Project: Revisioning (third-party module)
Version: 7.x
Date: 2012-January-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Hash DOS attack prevention with Suhosin needs a .htaccess edit - PSA-2012-001

Date:

2012-January-11

Advisory ID: DRUPAL-PSA-2012-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2012-01-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Denial of Service

SA-CONTRIB-2012-008 - Video Filter - Cross Site Scripting

By Drupal Security Team on 11 Jan 2012 at 20:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-008
Project: Video Filter (third-party module)
Version: 6.x, 7.x
Date: 2012-JANUARY-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-007 - Password Policy - Multiple vulnerabilities

By Drupal Security Team on 11 Jan 2012 at 17:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-007
Project: Password policy (third-party module)
Version: 6.x
Date: 2012-January-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-006 XSS and CSRF in Multiple Modules - Supercron, Taxotouch, Admin:hover, Taxonomy Navigator no longer supported

By Drupal Security Team on 11 Jan 2012 at 17:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-006
Projects: SuperCron, Taxotouch, Taxonomy Navigator, Admin:hover (third-party modules)
Version: 6.x, 7.x
Date: 2012-January-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-005 - Vote up/down - Cross Site Scripting

By Drupal Security Team on 11 Jan 2012 at 16:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-005
Project: Vote Up/Down (third-party module)
Version: 6.x
Date: 2012-January-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-004 - Date - SQL injection

By Drupal Security Team on 11 Jan 2012 at 14:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-004
Project: Date (third-party module)
Version: 6.x
Date: 2012-January-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2012-003 - Fill PDF - Multiple vulnerabilities

By Drupal Security Team on 4 Jan 2012 at 23:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-003
Project: Fill PDF (third-party module)
Version: 6.x, 7.x
Date: 2012-JANUARY-04
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Arbitrary code execution

SA-CONTRIB-2012-002 - Lingotek - Cross Site Scripting

By Drupal Security Team on 4 Jan 2012 at 20:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-002
Project: Lingotek Collaborative Translation (third-party module)
Version: 6.x
Date: 2012-January-04
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-001 - Registration Codes - Access bypass

By Drupal Security Team on 4 Jan 2012 at 19:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-001
Project: Registration Codes (third-party module)
Version: 6.x
Date: 2012-January-04
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-059 - Meta tags quick - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Dec 2011 at 18:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-059
Project: Meta tags quick (third-party module)
Version: 7.x
Date: 2011-December-14
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-058 - Support Timer - Cross Site Scripting (XSS)

By Drupal Security Team on 30 Nov 2011 at 20:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-058
Project: Support Timer (third-party module)
Version: 6.x
Date: 2011-November-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-057 - Support Ticketing System - Cross Site Scripting (XSS)

By Drupal Security Team on 30 Nov 2011 at 20:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-057
Project: Support Ticketing System (third-party module)
Version: 6.x
Date: 2011-November-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-056 - Webform Validation Cross Site Scripting

By Drupal Security Team on 30 Nov 2011 at 20:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-056
Project: Webform Validation (third-party module)
Version: 6.x, 7.x
Date: 2011-November-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-055 - Webform CiviCRM Integration - Multiple vulnerabilities

By Drupal Security Team on 9 Nov 2011 at 22:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-055
Project: Webform CiviCRM Integration (third-party module)
Version: 6.x, 7.x
Date: 2011-November-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, SQL Injection

SA-CONTRIB-2011-054 - CKEditor - Access bypass

By Drupal Security Team on 9 Nov 2011 at 21:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-054
Project: CKEditor - WYSIWYG HTML editor (third-party module)
Version: 7.x
Date: 2011-November-09
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-053 - Quiz - Cross Site Scripting

By Drupal Security Team on 9 Nov 2011 at 20:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-053
Project: Quiz (third-party module)
Version: 6.x
Date: 2011-November-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-052 - Views SQL Injection

By Drupal Security Team on 2 Nov 2011 at 22:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-052
Project: Views (third-party module)
Version: 6.x
Date: 2011-November-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-051 - Hotblocks module - multiple vulnerabilities

By Drupal Security Team on 2 Nov 2011 at 19:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-051
Project: HotBlocks (third-party module)
Version: 6.x
Date: 2011-November-02
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2011-050 - Organic groups - Access bypass

By Drupal Security Team on 26 Oct 2011 at 15:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-050
Project: Organic groups (third-party module)
Version: 7.x
Date: 2011-October-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-049 - Cumulus - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Oct 2011 at 16:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-049
Project: Cumulus (third-party module)
Version: 5.x, 6.x
Date: 2011-October-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2011-048 - Certificate Login SQL Injection

By Drupal Security Team on 12 Oct 2011 at 16:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-048
Project: Certificate Login (third-party module)
Version: 5.x, 6.x
Date: 2011-October-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-047 - OG Features access bypass

By Drupal Security Team on 5 Oct 2011 at 19:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-047
Project: OG Features (third-party module)
Version: 6.x
Date: 2011-October-05
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-046 - Echo - Multiple Vulnerabilities

By Drupal Security Team on 5 Oct 2011 at 18:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-046
Project: Echo (third-party module)
Version: 6.x, 7.x, 8.x
Date: 2011-October-05
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2011-045 - Rate module Cross Site Scripting

By Drupal Security Team on 5 Oct 2011 at 17:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-045
Project: Rate (third-party module)
Version: 6.x, 7.x
Date: 2011-October-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2011-044 - Homebox for Organic Groups Cross Site Scripting

By Drupal Security Team on 5 Oct 2011 at 17:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-044
Project: Homebox (third-party module)
Version: 6.x, 7.x
Date: 2011-October-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2011-043 - Petition Node - Cross Site Scripting

By Drupal Security Team on 5 Oct 2011 at 13:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-043
Project: petition_node (third-party module)
Version: 6.x
Date: 2011-October-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-042 Views Bulk Operations - Cross Site Scripting

By Drupal Security Team on 21 Sep 2011 at 21:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-042
Project: Views Bulk Operations (VBO) (third-party module)
Version: 6.x
Date: 2011-September-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-041 - Hostmaster (Aegir) - Cross Site Scripting

By Drupal Security Team on 21 Sep 2011 at 16:43 UTC

Advisory ID: SA-CONTRIB-2011-041
Project: Hostmaster (Aegir) (third-party module)
Version: 6.x
Date: 2011-September-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-040 Author Pane access bypass

By Drupal Security Team on 7 Sep 2011 at 14:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-040
Project: Author Pane (third-party module)
Version: 6.x
Date: 2011-September-7
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities

By Drupal Security Team on 31 Aug 2011 at 17:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-039
Project: Bot Alarm (third-party module)
Version: 6.x
Date: 2011-August-31
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2011-038 - Taxonomy Views Integrator - Cross Site Scripting

By Drupal Security Team on 31 Aug 2011 at 13:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-038
Project: Taxonomy Views Integrator (third-party module)
Version: 6.x
Date: 2011-August-31
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS