Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2012-166 - Table of Contents - Access Bypass

By Drupal Security Team on 14 Nov 2012 at 21:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-166
Project: Table of Contents (third-party module)
Version: 6.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Nov 2012 at 20:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-165
Project: Chaos tool suite (ctools) (third-party module)
Version: 6.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-164 - Smiley module and Smileys module - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Nov 2012 at 19:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-164
Project: Smiley (third-party module)
Project: Smileys (third-party module)
Version: 6.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-163 - User Read-Only - Permission escalation

By Drupal Security Team on 14 Nov 2012 at 19:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-163
Project: User Read-Only (third-party module)
Version: 6.x, 7.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)

By Drupal Security Team on 14 Nov 2012 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-162
Project: RESTful Web Services (third-party module)
Version: 7.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-161 - Webform CiviCRM Integration - Access Bypass

By Drupal Security Team on 7 Nov 2012 at 21:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-161
Project: Webform CiviCRM Integration (third-party module)
Version: 7.x
Date: 2012-November-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-160 - OM Maximenu - Cross Site Scripting (XSS)

By Drupal Security Team on 7 Nov 2012 at 21:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-160
Project: OM Maximenu (third-party module)
Version: 6.x, 7.x
Date: 2012-November-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-159 - Password policy - Information leakage of hashed passwords

By Drupal Security Team on 31 Oct 2012 at 18:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-159
Project: Password policy (third-party module)
Version: 6.x, 7.x
Date: 2012-October-31
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-158 - MailChimp - Cross Site Scripting (XSS)

By Drupal Security Team on 24 Oct 2012 at 18:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-158
Project: MailChimp (third-party module)
Version: 7.x
Date: 2012-October-24
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-157 - Time Spent - Multiple Vulnerabilities - (unsupported)

By Drupal Security Team on 24 Oct 2012 at 16:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-157
Project: Time Spent (third-party module)
Version: 6.x, 7.x
Date: 2012-October-24
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery, SQL Injection, Multiple vulnerabilities

SA-CORE-2012-003 - Drupal core - Arbitrary PHP code execution and Information disclosure

By Drupal Security Team on 17 Oct 2012 at 21:29 UTC

Advisory ID: DRUPAL-SA-CORE-2012-003
Project: Drupal core
Version: 7.x
Date: 2012-October-17
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Information Disclosure, Arbitrary PHP code execution

SA-CONTRIB-2012-156 - Search API - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 17 Oct 2012 at 18:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-156
Project: Search API (third-party module)
Version: 7.x
Date: 2012-October-17
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-155 - ShareThis - Cross Site Scripting (XSS)

By Drupal Security Team on 10 Oct 2012 at 17:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-155
Project: ShareThis (third-party module)
Version: 7.x
Date: 2012-October-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-154 - Basic webmail - Multiple vulnerabilities

By Drupal Security Team on 10 Oct 2012 at 17:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-154
Project: Basic webmail (third-party module)
Version: 6.x
Date: 2012-October-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilities

SA-CONTRIB-2012-153 - Mandrill - Information Disclosure

By Drupal Security Team on 10 Oct 2012 at 16:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-153
Project: Mandrill (third-party module)
Version: 7.x
Date: 2012-October-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-152 - Feeds - Access bypass

By Drupal Security Team on 10 Oct 2012 at 16:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-152
Project: Feeds (third-party module)
Version: 7.x
Date: 2012-October-10
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-151 - Commerce Extra Panes - Cross Site Request Forgery

By Drupal Security Team on 3 Oct 2012 at 15:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-151
Project: Commerce extra panes (third-party module)
Version: 7.x
Date: 2012-October-3
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-150 - Twitter Pull - Cross Site Scripting (XSS)

By Drupal Security Team on 3 Oct 2012 at 15:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-150
Project: Twitter Pull (third-party module)
Version: 6.x, 7.x
Date: 2012-October-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-149 - Hostip - Cross Site Scripting (XSS)

By Drupal Security Team on 3 Oct 2012 at 15:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-149
Project: Hostip (third-party module)
Version: 6.x, 7.x
Date: 2012-October-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-148 - OG - Access Bypass

By Drupal Security Team on 26 Sep 2012 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-148
Project: Organic groups (third-party module)
Version: 7.x
Date: 2012-September-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-147 - FileField Sources - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Sep 2012 at 17:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-147
Project: FileField Sources (third-party module)
Version: 6.x, 7.x
Date: 2012-September-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-146 - Simplenews Scheduler - Arbitrary code execution

By Drupal Security Team on 19 Sep 2012 at 16:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-146
Project: Simplenews Scheduler (third-party module)
Version: 6.x
Date: 2012-September-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Arbitrary PHP code execution

SA-CONTRIB-2012-145 - Imagemenu - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Sep 2012 at 16:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-145
Project: Imagemenu (third-party module)
Version: 6.x
Date: 2012-September-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-144 Fonecta verify - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Sep 2012 at 16:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-144
Project: Fonecta verify (third-party module)
Version: 7.x
Date: 2012-September-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-143 PRH Search - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Sep 2012 at 16:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-143
Project: PRH Search (third-party module)
Version: 7.x
Date: 2012-September-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-142 - Spambot - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Sep 2012 at 16:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-142
Project: Spambot (third-party module)
Version: 6.x, 7.x
Date: 2012-September-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-141 - Mass Contact - Access bypass

By Drupal Security Team on 12 Sep 2012 at 20:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-141
Project: Mass Contact (third-party module)
Version: 6.x
Date: 2012-September-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-140 - Inf08 - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Sep 2012 at 18:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-140
Project: Inf08 (third-party module)
Version: 6.x
Date: 2012-September-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-139 - PDFThumb OS Injection

By Drupal Security Team on 12 Sep 2012 at 17:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-139
Project: PDFThumb (third-party module)
Version: 7.x
Date: 2012-September-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: OS Injection

SA-CONTRIB-2012-138 - Exposed Filter Data - Cross Site Scripting (XSS)

By Drupal Security Team on 5 Sep 2012 at 19:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-138
Project: Exposed Filter Data (third-party module)
Version: 6.x
Date: 2012-September-05
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-137 - Heartbeat - Cross Site Request Forgery (CSRF) in heartbeat_comments

By Drupal Security Team on 5 Sep 2012 at 17:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-137
Project: Heartbeat (third-party module)
Version: 6.x, 7.x
Date: 2012-September-5
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-136 - Apache Solr Search Autocomplete - Cross Site Scripting (XSS)

By Drupal Security Team on 29 Aug 2012 at 21:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-136
Project: Apache Solr Autocomplete (third-party module)
Version: 6.x, 7.x
Date: 2012-August-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-135 - CAPTCHA - Insufficient anti-automation prevention

By Drupal Security Team on 29 Aug 2012 at 18:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-135
Project: CAPTCHA (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-134 - Views - Privilege Escalation

By Drupal Security Team on 29 Aug 2012 at 18:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-134
Project: Views (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Critical
Exploitable from: Remote
Vulnerability: Privilege escalation

SA-CONTRIB-2012-133 - Taxonomy Image - Cross Site Scripting (XSS) & Arbitrary PHP code execution

By Drupal Security Team on 29 Aug 2012 at 18:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-133
Project: Taxonomy Image (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Arbitrary PHP code execution

SA-CONTRIB-2012-132 - Announcements - Access Bypass

By Drupal Security Team on 29 Aug 2012 at 18:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-132
Project: Announcements (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-131 - Email Field - Access Bypass

By Drupal Security Team on 29 Aug 2012 at 18:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-131
Project: Email Field (third-party module)
Version: 6.x, 7.x
Date: 2012-August-29
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-130 - Jstool - Multiple Vulnerabilities

By Drupal Security Team on 29 Aug 2012 at 15:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-130
Project: Javascript Tool (third-party module)
Version: 7.x
Date: 2012-August-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2012-129 - Activism - Access Bypass

By Drupal Security Team on 29 Aug 2012 at 14:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-129
Project: Activism (third-party module)
Version: 6.x
Date: 2012-08-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2012-128 - Elegant Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 15 Aug 2012 at 17:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-128
Project: Elegant Theme (third-party module)
Version: 7.x
Date: 2012-August-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-127 - Custom Publishing Options - Cross Site Scripting (XSS) Vulnerability

By Drupal Security Team on 15 Aug 2012 at 16:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-127
Project: Custom Publishing Options (third-party module)
Version: 6.x
Date: 2012-August-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-126 - Hotblocks - Cross Site Scripting (XSS) and Denial of Service (DoS)

By Drupal Security Team on 15 Aug 2012 at 16:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-126
Project: HotBlocks (third-party module)
Version: 6.x
Date: 2012-August-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Multiple vulnerabilities

SA-CONTRIB-2012-125 - Chaos tool suite (ctools) - Local File Inclusion and Cross Site Scripting (XSS)

By Drupal Security Team on 8 Aug 2012 at 18:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-125
Project: Chaos tool suite (ctools) (third-party module)
Version: 6.x, 7.x
Date: 2012-August-8
Security risk: Critical
Exploitable from: Remote
Vulnerability: Local File Inclusion and Cross Site Scripting

SA-CONTRIB-2012-124 - Mime Mail - Access Bypass

By Drupal Security Team on 8 Aug 2012 at 17:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-124
Project: Mime Mail (third-party module)
Version: 6.x
Date: 2012-August-8
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-123 - Shibboleth authentication - Access Bypass

By Drupal Security Team on 8 Aug 2012 at 17:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-123
Project: Shibboleth authentication (third-party module)
Version: 6.x
Date: 2012-August-8
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-122 - Better Revisions - Cross Site Scripting (XSS)

By Drupal Security Team on 8 Aug 2012 at 16:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-122
Project: Better Revisions (third-party module)
Version: 7.x
Date: 2012-August-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-121 - Shorten URLs - Cross Site Scripting (XSS)

By Drupal Security Team on 8 Aug 2012 at 15:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-121
Project: Shorten URLs (third-party module)
Version: 6.x, 7.x
Date: 2012-August-8
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-120 - Monthly Archive by Node Type - Access Bypass (unsupported)

By Drupal Security Team on 1 Aug 2012 at 15:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-120
Project: Monthly Archive by Node Type (third-party module)
Version: 6.x
Date: 2012-August-1
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-119 - Excluded Users - Cross Site Scripting (XSS)

By Drupal Security Team on 1 Aug 2012 at 13:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-119
Project: Excluded Users (third-party module)
Version: 6.x
Date: 2012-August-1
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-118 - Secure Login - Open Redirect

By Drupal Security Team on 25 Jul 2012 at 19:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-118
Project: Secure Login (third-party module)
Version: 7.x
Date: 2012-July-25
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Open Redirect

Pages

Subscribe with RSS