Security advisories | Drupal.org

Advisory ID: DRUPAL-SA-CONTRIB-2010-083
Project: UC2Checkout, UCPaypal, UC Cart LInks (third-party modules in the Ubercart Project)
Version: 5.x, 6.x
Date: 2010-Aug-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass, Cross Site Request Forgery

SA-CONTRIB-2010-082 - Print - Local file read access

By Drupal Security Team on 11 Aug 2010 at 18:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-082
Project: Printer, e-mail and PDF versions (third-party module)
Version: 5.x, 6.x
Date: 2010-August-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Local file read access

SA-CONTRIB-2010-081 - FileField Sources - Arbitrary Code Execution

By Drupal Security Team on 11 Aug 2010 at 18:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-081
Project: FileField Sources (third-party module)
Version: 6.x
Date: 2010-August-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary Code Execution

SA-CONTRIB-2010-080 - Privatemsg - Cross Site Scripting

By Drupal Security Team on 11 Aug 2010 at 13:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-080
Project: Privatemsg (third-party module)
Version: 6.x
Date: 2010-August-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-Site Scripting

SA-CONTRIB-2010-079 - Devel (Performance logging) - Cross Site Scripting

By kbahey on 4 Aug 2010 at 22:39 UTC

Advisory ID: SA-CONTRIB-2010-079
Project: Devel (third-party module)
Version: 5.x, 6.x
Date: 2010-Aug-04
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-078 - Kaltura - Information disclosure

By Drupal Security Team on 28 Jul 2010 at 22:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-078
Project: Kaltura (third-party module)
Versions: 5.x, 6.x
Date: 2010-July-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information disclosure

SA-CONTRIB-2010-077 - Sage Pay (former Protx) Direct Payment Gateway for Ubercart - Information Disclosure

By Drupal Security Team on 28 Jul 2010 at 17:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-077
Project: Sage Pay Direct Payment Gateway for Ubercart (third-party module)
Version: 5.x, 6.x
Date: 2010-July-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2010-076 - Dashboard - Cross Site Scripting (CSS)

By Drupal Security Team on 28 Jul 2010 at 16:11 UTC

Advisory ID: SA-CONTRIB-2010-076
Project: Dashboard (third-party module)
Version: 6.x
Date: 2010-July-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB 2010-075 - Tagging - Cross Site Scripting

By Drupal Security Team on 21 Jul 2010 at 18:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-075
Project: Tagging (third-party module)
Version: 6.x
Date: 2010-July 21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-074 - Drupad - Cross-site request forgery

By Drupal Security Team on 14 Jul 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-074
Projects: Drupad (third-party module)
Version: 6.x
Date: 2010-07-14
Security risks: Critical
Exploitable from: Remote
Vulnerability: CSRF

SA-CONTRIB-2010-073 - Multiple Vulnerabilities In Multiple Contributed Modules

By Drupal Security Team on 14 Jul 2010 at 20:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-073
Projects: Multiple third party modules - Simple Gallery, OG Menu, Tell A Friend Node, JsMath For Displaying Mathematics With TeX
Version: 5.x, 6.x
Date: 2010-July-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple (Cross Site Scripting, Email Header Injection)

SA-CONTRIB-2010-072: Hierarchical Select - Cross Site Scripting

By Drupal Security Team on 7 Jul 2010 at 16:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-072
Project: Hierarchical Select (third-party module)
Version: 5.x, 6.x
Date: 2010-July-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-071 - MultiSafepay Integration - Cross Site Request Forgery

By greggles on 7 Jul 2010 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-071
Project: MultiSafepay Integration (third-party module)
Version: 6.x
Date: 2010-July-07
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2010-070 - Multiple vulnerabilities in multiple contributed modules

By Drupal Security Team on 23 Jun 2010 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-070
Projects: Multiple third party modules - Easy Translator, Block Queue, Multiple Image Upload (Imagex)
Version: 5.x, 6.x
Date: 2010-06-23
Security risks: Critical
Exploitable from: Remote
Vulnerability: Multiple (SQL Injection, CSRF, Access bypass)

SA-CONTRIB-2010-069 - Case Tracker - Multiple Vulnerabilities

By Drupal Security Team on 23 Jun 2010 at 18:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-069
Project: Case Tracker (third-party module)
Version: 5.x
Date: 2010-June-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple Vulnerabilities

SA-CONTRIB-2010-068 - Masquerade - Cross Site Request Forgery

By Drupal Security Team on 23 Jun 2010 at 17:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-068
Project: Masquerade (third-party module)
Version: 5.x, 6.x
Date: 2010-June-23
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2010-067 - Views - Multiple vulnerabilities

By Drupal Security Team on 17 Jun 2010 at 02:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-067
Project: Views (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-066 - FileField - Cross Site Scripting

By Drupal Security Team on 17 Jun 2010 at 01:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-066
Project: FileField (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Views - Administer views permission - PSA-2010-002

Date:

2010-June-16

Advisory ID: PSA-2010-002
Project: Views (third-party module)
Versions: 5.x, 6.x
Date: 2010-June-16
Security risk: Not critical

SA-CONTRIB-2010-065 - Content Construction Kit (CCK) - Access Bypass

By Drupal Security Team on 16 Jun 2010 at 20:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-065
Project: Content Construction Kit (CCK) (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-064 - Ubercart MIGS Payment Gateway - Web Parameter Tampering

By Drupal Security Team on 16 Jun 2010 at 19:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-064
Project: Ubercart MIGS Payment Gateway (third-party module)
Versions: 6.x
Date: 2010-Jun-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Web Parameter Tampering

SA-CONTRIB-2010-063 - Studio theme pack - Cross Site Scripting

By Drupal Security Team on 16 Jun 2010 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-063
Project: Studio theme pack (third-party theme)
Version: 6.x
Date: 2010-June-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-062 - Ogone | Ubercart payment - Access Bypass

By Drupal Security Team on 16 Jun 2010 at 18:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-062
Project: Ogone | Ubercart payment (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-061 - AddonChat - Multiple Vulnerabilities

By Drupal Security Team on 26 May 2010 at 20:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-061
Project: AddonChat (third-party module)
Version: 6.x-1.x
Date: 2010-May-26
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Multiple (Privilege Escalation, Cross-site scripting)

SA-CONTRIB-2010-060 - Scheduler - Cross Site Scripting

By Drupal Security Team on 26 May 2010 at 19:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-060
Project: Scheduler (third-party module)
Version: 5.x, 6.x
Date: 2010-May-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-059: Panels - Arbitrary PHP code execution

By Drupal Security Team on 20 May 2010 at 02:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-059
Project: Panels (third-party module)
Versions: 6.x
Date: 2010 May 19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary PHP code execution

SA-CONTRIB-2010-058: Chaos tool suite - Multiple vulnerabilities

By Drupal Security Team on 20 May 2010 at 02:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-058
Project: Chaos tool suite (third-party module)
Versions: 6.x
Date: 2010 May 19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-057 - Rotor Banner - Cross Site Scripting (XSS)

By Drupal Security Team on 20 May 2010 at 02:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-057
Project: Rotor Banner (third-party module)
Versions: 6.x-2.x, 5.x-1.x
Date: 2010-May-19
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-056 - User Queue - Cross Site Request Forgery

By Drupal Security Team on 19 May 2010 at 23:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-056
Project: User Queue (third-party module)
Versions: 6.x
Date: 2010-May-19
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-055 - Simplenews - Access bypass

By Drupal Security Team on 19 May 2010 at 22:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-055
Project: Simplenews (third-party module)
Version: 6.x
Date: 2010-May-19
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2010-054 - Storm - Cross Site Scripting (XSS)

By Drupal Security Team on 19 May 2010 at 22:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-054
Project: Storm (third-party module)
Version: 6.x
Date: 2010-May-19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2010-053 - External Link Page - Cross Site Scripting (XSS)

By Drupal Security Team on 19 May 2010 at 22:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-053
Project: External Link Page (third-party module)
Version: 5.x, 6.x
Date: 2010-May-19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-052 - Multiple vulnerabilities in multiple contributed modules

By Drupal Security Team on 19 May 2010 at 21:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-052
Projects: Multiple third party modules - Privatemsg, Weather Underground, Tellafriend, Menu Block Split, osCommerce, Download Count, Comment Page, False Account Detector, User Queue
Version: 5.x, 6.x
Date: 2010-05-19
Security risks: Critical
Exploitable from: Remote
Vulnerability: Multiple (Cross-site Request Forgery, Cross-site scripting, Email header injection, SQL Injection)