Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2010-045 - Auto Assign Role - Access bypass

By Drupal Security Team on 12 May 2010 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-045
Project: Auto Assign Role (third-party module)
Version: 6.x
Date: 2010-May-12
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-044: Bibliography - Cross Site Scripting

By Drupal Security Team on 12 May 2010 at 18:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-044
Project: Bibliography (third-party module)
Version: 5.x, 6.x
Date: 2010-May-12
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-043: Wordfilter - Cross Site Scripting

By Drupal Security Team on 12 May 2010 at 18:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-043
Project: Wordfilter (third-party module)
Version: 5.x, 6.x
Date: 2010-May-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-042: LoginToboggan - Session fixation

By Drupal Security Team on 12 May 2010 at 17:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-042
Project: LoginToboggan (third-party module)
Version: 5.x, 6.x
Date: 2010-05-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Session fixation

SA-CONTRIB-2010-041: ImageField - Access Bypass

By Drupal Security Team on 6 May 2010 at 00:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-041
Project: ImageField (third-party module)
Version: 6.x
Date: 2010-May-5
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-040: FileField - Access Bypass

By Drupal Security Team on 6 May 2010 at 00:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-040
Project: FileField (third-party module)
Version: 6.x
Date: 2010-May-5
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-039: CCK TableField - Cross Site Scripting

By Drupal Security Team on 5 May 2010 at 22:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-039
Project: CCK TableField (third-party module)
Version: 6.x
Date: 2010-May-05
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-038 - Privatemsg - Access bypass

By Drupal Security Team on 28 Apr 2010 at 20:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-038
Project: Privatemsg (third-party module)
Version: 6.x
Date: 2010-April-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-037 - Decisions - Access bypass

By Drupal Security Team on 28 Apr 2010 at 18:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-037
Project: Decisions (third-party module)
Version: 5.x, 6.x
Date: 2010-April-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-036 - Views - multiple vulnerabilities

By pwolanin on 8 Apr 2010 at 00:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-036
Project: Views (third-party module)
Version: 5.x, 6.x
Date: 2010-April-7
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS), arbitrary code execution

SA-CONTRIB-2010-035: Smileys - Cross Site Request Forgery

By Drupal Security Team on 7 Apr 2010 at 22:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-035
Project: Smileys (third-party module)
Versions: 5.x
Date: 2010-April-07
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-034 - Internationalization - Cross Site Scripting

By Drupal Security Team on 7 Apr 2010 at 22:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-034
Project: Internationalization (third-party module)
Version: 6.x
Date: 2010-April-7
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-033 - Taxonomy Filter - Cross Site Scripting (XSS)

By Drupal Security Team on 31 Mar 2010 at 20:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-033
Project: Taxonomy Filter (third-party module)
Version: 6.x
Date: 2010-March-31
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-032 - Taxonomy Breadcrumb - Cross Site Scripting (XSS)

By Drupal Security Team on 31 Mar 2010 at 15:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-032
Project: Taxonomy Breadcrumb (third-party module)
Versions: 6.x-1.x, 5.x-1.x
Date: 2010-March-31
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-031 - Menu Block - Cross Site Scripting (XSS)

By Drupal Security Team on 24 Mar 2010 at 23:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-031
Project: Menu Block (third-party module)
Versions: 6.x-2.x, 5.x-2.x, 5.x-1.x
Date: 2010-March-24
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-030: Mime Mail - Arbitrary code execution

By Drupal Security Team on 24 Mar 2010 at 18:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-030
Project: Mime Mail (third-party module)
Version: 5.x
Date: 2010-March-24
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-029: Keys - Cross-site Request Forgery

By Drupal Security Team on 17 Mar 2010 at 20:43 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-029
Project: Keys (third-party module)
Version: 6.x
Date: 2010-March-17
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-028 - Tag Order - Cross Site Scripting

By Drupal Security Team on 17 Mar 2010 at 20:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-028
Project: Tag Order (third-party module)
Version: 5.x, 6.x
Date: 2010-March-17
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-027: Email Input Filter - Arbitrary code execution

By Drupal Security Team on 17 Mar 2010 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-027
Project: Email Input Filter (third-party module)
Version: 5.x, 6.x
Date: 2010-March-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-026 - Monthly Archive by Node Type - Access Bypass

By Drupal Security Team on 10 Mar 2010 at 16:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-026
Project: Monthly Archive by Node Type (third-party module)
Version: 6.x (all branches)
Date: 2010-March-10
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-025 - TinyMCE - Cross Site Scripting (XSS)

By greggles on 10 Mar 2010 at 14:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-025
Project: TinyMCE (third-party module)
Version: 5.x
Date: 2010-March-09
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2010-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 3 Mar 2010 at 19:31 UTC

Advisory ID: DRUPAL-SA-CORE-2010-001
Project: Drupal core
Version: 5.x, 6.x
Date: 2010-March-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Open redirect, Authorization vulnerability

SA-CONTRIB-2010-024 - eTracker - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 19:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-024
Project: eTracker (third-party module)
Version: 6.x-1.1
Date: 2010-March-03
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-023 - Workflow - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 18:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-023
Project: Workflow (third-party module)
Version: 6.x, 5.x
Date: 2010-March-03
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-022 - Internationalization - Arbitrary code execution

By Drupal Security Team on 3 Mar 2010 at 18:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-022
Project: Internationalization (third-party module)
Version: 6.x-1.x 5.x-2.x
Date: 2010-March-03
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-021 - AddThis Button - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 17:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-021
Project: AddThis Button (third-party module)
Version: 6.x, 5.x
Date: 2010-March-03
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-020 - Facebook-style Statuses (Microblog) - Access bypass

By Drupal Security Team on 24 Feb 2010 at 22:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-020
Project: Facebook-style Statuses (Microblog) (third-party module)
Version: 6.x-2.x
Date: 2010-February-24
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2010-019 - Weekly Archive by Node Type - Access Bypass

By Drupal Security Team on 24 Feb 2010 at 16:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-019
Project: Weekly Archive by Node Type (third-party module)
Version: 6.x-2.x
Date: 2010-February-24
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-018 - Content Distribution - Multiple Vulnerabilities

By Drupal Security Team on 17 Feb 2010 at 22:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-018
Project: Content Distribution (third-party module)
Version: 6.x
Date: 2010 February 17
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Mulitple Vulnerabilities

SA-CONTRIB-2010-017 - iTweak Upload - Cross Site Scripting

By Drupal Security Team on 17 Feb 2010 at 18:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-017
Project: iTweak Upload (third-party module)
Version: 6.x
Date: 2010 February 17
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-016 - Graphviz Filter - arbitrary code execution

By Drupal Security Team on 10 Feb 2010 at 23:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-016
Project: Graphviz Filter (third-party module)
Version: 6.x, 5.x
Date: 2010 February 10
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-015 - Signwriter - Arbitrary code execution

By Drupal Security Team on 3 Feb 2010 at 20:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-015
Project: Signwriter (third-party module)
Version: 5.x, 6.x
Date: 2010-February-3
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-014 - Node Export - Arbitrary code execution

By Drupal Security Team on 3 Feb 2010 at 19:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-014
Project: Node Export (third-party module)
Version: 5.x, 6.x
Date: 2010-February-3
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-013 - Menu Breadcrumb - Cross site scripting

By Drupal Security Team on 3 Feb 2010 at 16:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-013
Project: Menu Breadcrumb (third-party module)
Version: 6.x
Date: 2010-February-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-012 - ODF Import - Access Bypass (possible Cross Site Scripting)

By greggles on 3 Feb 2010 at 15:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-012
Project: ODF Import (third-party module)
Version: 6.x-1.0
Date: 2010-February-3
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-011 - Feedback - Cross Site Scripting

By Drupal Security Team on 27 Jan 2010 at 22:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-011
Project: Feedback (third-party module)
Version: 5.x, 6.x
Date: 2010-January-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-010 - Author Contact - Cross site scripting

By coltrane on 27 Jan 2010 at 20:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-010
Project: Author Contact (third-party module)
Version: 5.x, 6.x
Date: 2010-January-27
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-009 - Block Class - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-009
Project: Block Class (third-party module)
Version: 6.x-1.2, 5.x-1.1
Date: 2010-January-20
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-008 - Recent Comments - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-008
Project: Recent Comments (third-party module)
Version: 6.x-1.0, 5.x-1.2
Date: 2010-January-20
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-007 - Control Panel - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-007
Project: Control Panel (third-party module)
Version: 5.x, 6.x
Date: 2010-January-20
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-006 - Bibliography Module - Cross Site Scripting

By Drupal Security Team on 13 Jan 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-006
Project: Bibliography (third-party module)
Version: 5.x, 6.x
Date: 2010-January-13
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-005 - Own Term - Cross site scripting

By coltrane on 13 Jan 2010 at 17:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-005
Project: Own Term (third-party module)
Version: 6.x-1.0
Date: 2010-January-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-004 - Node block - Cross site scripting

By Drupal Security Team on 13 Jan 2010 at 17:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-004
Project: Node Block (third-party module)
Version: 6.13, 5.11
Date: 2010-January-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-003 - Forward - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 23:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-003
Project: Forward (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple XSS vulnerabilities

SA-CONTRIB-2010-002 - Currency Exchange - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 19:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-002
Project: Currency Exchange (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-001 - Wunderbar - Cross Site Scripting

By Drupal Security Team on 6 Jan 2010 at 19:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-001
Project: Wunderbar! (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-115 - Autocomplete Widgets for CCK Text and Number - Information Disclosure

By Drupal Security Team on 30 Dec 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-115
Project: Autocomplete Widgets for CCK Text and Number (third-party module)
Version: 6.x
Date: 2009-December-30
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2009-114 - Automated Logout - Cross Site Scripting

By Drupal Security Team on 24 Dec 2009 at 03:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-114
Project: Automated Logout (third-party module)
Version: 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-113 - FAQ - Cross Site Scripting

By Drupal Security Team on 23 Dec 2009 at 18:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-113
Project: FAQ (third-party module)
Version: 5.x, 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2009-009 - Drupal Core - Cross site scripting

By Drupal Security Team on 16 Dec 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CORE-2009-009
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

Pages

Subscribe with RSS