Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2010-013 - Menu Breadcrumb - Cross site scripting

By Drupal Security Team on 3 Feb 2010 at 16:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-013
Project: Menu Breadcrumb (third-party module)
Version: 6.x
Date: 2010-February-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-012 - ODF Import - Access Bypass (possible Cross Site Scripting)

By greggles on 3 Feb 2010 at 15:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-012
Project: ODF Import (third-party module)
Version: 6.x-1.0
Date: 2010-February-3
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-011 - Feedback - Cross Site Scripting

By Drupal Security Team on 27 Jan 2010 at 22:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-011
Project: Feedback (third-party module)
Version: 5.x, 6.x
Date: 2010-January-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-010 - Author Contact - Cross site scripting

By coltrane on 27 Jan 2010 at 20:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-010
Project: Author Contact (third-party module)
Version: 5.x, 6.x
Date: 2010-January-27
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-009 - Block Class - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-009
Project: Block Class (third-party module)
Version: 6.x-1.2, 5.x-1.1
Date: 2010-January-20
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-008 - Recent Comments - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-008
Project: Recent Comments (third-party module)
Version: 6.x-1.0, 5.x-1.2
Date: 2010-January-20
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-007 - Control Panel - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-007
Project: Control Panel (third-party module)
Version: 5.x, 6.x
Date: 2010-January-20
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-006 - Bibliography Module - Cross Site Scripting

By Drupal Security Team on 13 Jan 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-006
Project: Bibliography (third-party module)
Version: 5.x, 6.x
Date: 2010-January-13
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-005 - Own Term - Cross site scripting

By coltrane on 13 Jan 2010 at 17:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-005
Project: Own Term (third-party module)
Version: 6.x-1.0
Date: 2010-January-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-004 - Node block - Cross site scripting

By Drupal Security Team on 13 Jan 2010 at 17:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-004
Project: Node Block (third-party module)
Version: 6.13, 5.11
Date: 2010-January-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-003 - Forward - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 23:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-003
Project: Forward (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple XSS vulnerabilities

SA-CONTRIB-2010-002 - Currency Exchange - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 19:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-002
Project: Currency Exchange (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-001 - Wunderbar - Cross Site Scripting

By Drupal Security Team on 6 Jan 2010 at 19:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-001
Project: Wunderbar! (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-115 - Autocomplete Widgets for CCK Text and Number - Information Disclosure

By Drupal Security Team on 30 Dec 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-115
Project: Autocomplete Widgets for CCK Text and Number (third-party module)
Version: 6.x
Date: 2009-December-30
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2009-114 - Automated Logout - Cross Site Scripting

By Drupal Security Team on 24 Dec 2009 at 03:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-114
Project: Automated Logout (third-party module)
Version: 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-113 - FAQ - Cross Site Scripting

By Drupal Security Team on 23 Dec 2009 at 18:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-113
Project: FAQ (third-party module)
Version: 5.x, 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2009-009 - Drupal Core - Cross site scripting

By Drupal Security Team on 16 Dec 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CORE-2009-009
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-112 - Sections - Cross Site Scripting

By Drupal Security Team on 16 Dec 2009 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-112
Project: Sections (third-party module)
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-111 - Randomizer - Cross Site Scripting

By Drupal Security Team on 9 Dec 2009 at 21:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-111
Project: Randomizer (third-party module)
Version: 5.x, 6.x
Date: 2009-December-09
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-110 - Taxonomy Timer - SQL Injection

By Drupal Security Team on 2 Dec 2009 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-110
Project: Taxonomy Timer (third-party module)
Version: 5.x, 6.x
Date: 2009-November-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2009-109 - Printfriendly - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 22:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-109
Project: Printfriendly (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-108 - Gallery Assist - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 22:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-108
Project: Gallery Assist (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-107 - Ubercart - Access bypass, Cross site request forgery

By Drupal Security Team on 18 Nov 2009 at 20:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-107
Project: Ubercart (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross-site request forgery

Description

Ubercart's PayPal Website Payments Standard integration exposes a path for completed orders without properly checking that the order is valid for the current user. In the event that the order has already been processed for checkout, this can result in duplicate actions taking place inadvertently. Furthermore, if the checkout completion message has been modified to include order details, information disclosure can happen.

The Ubercart order management was also affected by a minor cross-site request forgery vulnerability.

Versions affected

Ubercart module for Drupal 6.x prior to Ubercart 6.x-2.1
Ubercart module for Drupal 5.x prior to Ubercart 5.x-1.9

Drupal core is not affected. If you do not use the contributed Ubercart module, there is nothing you need to do.

Solution

Upgrade to the latest version:

SA-CONTRIB-2009-106 - Agreement - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-106
Project: Agreement (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-105 - Subgroups for Organic Groups - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 20:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-105
Project: Subgroups for Organic Groups (third-party module)
Version: 5.x
Date: 2009-November-18
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-104 - Feed Element Mapper - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 19:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-104
Project: Feed Element Mapper (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-103 - Strongarm - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 18:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-103
Project: Strongarm (third-party module)
Version: 6.x
Date: 2009 November 18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-102 - PHPList Integration Module - Cross Site Request Forgery

By pwolanin on 18 Nov 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-102
Project: PHPList Inegration Module (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-CONTRIB-2009-101 - Web Services - Access Bypass

By Drupal Security Team on 11 Nov 2009 at 22:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-101
Project: Web Services (third-party theme)
Version: 6.x
Date: 2009-November-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-100 - AddToAny - Cross Site Scripting

By undefined on 11 Nov 2009 at 22:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-100
Project: AddToAny (third-party module)
Version: 5.x, 6.x
Date: 2009 November 11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-099 - RootCandy Theme - Cross Site Scripting

By meba on 11 Nov 2009 at 21:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-099
Project: RootCandy (third-party theme)
Version: 6.x
Date: 2009-November-11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-098 - Zoomify - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 22:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-098
Project: Zoomify (third-party module)
Version: 5.x, 6.x
Date: 2009-November-4
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-097 - Organic Groups Vocabulary - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 22:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-097
Project: Organic Groups Vocabulary (third-party module)
Version: 6.x
Date: 2009-November-4
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-096 - Link - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 20:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-096
Project: Link (third-party module)
Version: 5.x, 6.x
Date: 2009-November-4
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass

By Drupal Security Team on 4 Nov 2009 at 20:02 UTC

Advisory ID: SA-CONTRIB-2009-095
Project: Smartqueues for Organic Groups (smartqueue_og) (third-party module)
Version: 6.x
Date: 2009 November 4
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-094 - NGP COO/CWP Integration (crmngp) - Multiple Vulnerabilities

By coltrane on 4 Nov 2009 at 19:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-094
Project: NGP COO/CWP Integration (crmngp) (third-party module)
Version: 6.x
Date: 2009-November-4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-site scripting and Access bypass

SA-CONTRIB-2009-093 - Temporary Invitation - Cross Site Scripting

By meba on 4 Nov 2009 at 19:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-093
Project: Temporary Invitation (third-party module)
Version: 5.x
Date: 2009 November 4
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-092 - S5 Presentation Player Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 19:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-092
Project: S5 Presentation Player (third-party module)
Version: 6.x
Date: 2009 November 4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-091 - Node Hierarchy - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 19:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-091
Project: Node Hierarchy (third-party module)
Version: 6.x, 5.x
Date: 2009 November 4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-090 - User Protect - Cross Site Request Forgery

By hunmonk on 4 Nov 2009 at 13:20 UTC

Advisory ID: SA-CONTRIB-2009-090
Project: User Protect (third-party module)
Version: 5.x, 6.x
Date: 2009-November-04
Security risk: Moderate
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-CONTRIB-2009-089 - Storm - Access Bypass

By greggles on 28 Oct 2009 at 22:43 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-089
Project: Storm (third-party module)
Version: 6.x
Date: 2009-October-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-088 - Workflow Multiple Cross Site Scripting Vulnerabilities

By greggles on 28 Oct 2009 at 22:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-088
Project: Workflow (third-party module)
Version: 6.x, 5.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-087 - FAQ Ask - Multiple Vulnerabilities

By greggles on 28 Oct 2009 at 21:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-087
Project: FAQ Ask (third-party module)
Version: 6.x
Date: 2009 October 28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple Vulnerabilities (XSS, CSRF, Open Redirect)

SA-CONTRIB-2009-086 - OpenSocial Shindig-Integrator - Cross Site Scripting

By Drupal Security Team on 28 Oct 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-086
Project: OpenSocial Shindig-Integrator (third-party module)
Version: 6.x, 5.x
Date: 2009-October-86
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-085 - Insert Node - Cross Site Scripting

By Drupal Security Team on 28 Oct 2009 at 21:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-085
Project: Insert Node (third-party module)
Version: 5.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-084 - LDAP Integration - Multiple Vulnerabilities

By Drupal Security Team on 28 Oct 2009 at 20:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-084
Project: LDAP Integration (third-party module)
Version: 6.x, 5.x
Date: 2009-October-28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-083 - CCK Comment Reference - Access Bypass

By Drupal Security Team on 28 Oct 2009 at 20:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-083
Project: CCK Comment Reference (third-party module)
Version: 6.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-082 - Filefield module access bypass

By greggles on 21 Oct 2009 at 22:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-082
Project: FileField (third-party module)
Version: 6.x
Date: 2009-October-20
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-081 - Abuse - Cross Site Scripting

By meba on 21 Oct 2009 at 21:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-081
Project: Abuse (third-party module)
Version: 5.x, 6.x
Date: 2009 October 21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-080 - Simplenews Statistics - Multiple vulnerabilities

By Drupal Security Team on 21 Oct 2009 at 20:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-080
Project: Simplenews Statistics (third-party module)
Version: 6.x
Date: 2009 October 21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities (XSS, CSRF, Open Redirect)

Pages

Subscribe with RSS