Security advisories | Drupal.org

Advisory ID: DRUPAL-SA-CONTRIB-2011-025
Project: Juitter - jQuery Twitter live search feeds and Download Count (third-party modules)
Version: 6.x
Date: 2011-June-22
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

External libraries and plugins - PSA-2011-002

Date:

2011-June-15

Advisory ID: PSA-2011-002
Date: 2011-June-15
Project: External libraries and plugins

SA-CONTRIB-2011-024 - Spam - Cross Site Request Forgery (CSFR)

By Drupal Security Team on 9 Jun 2011 at 02:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-024
Project: Spam (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2011-023 - Prepopulate - Multiple vulnerabilities

By Drupal Security Team on 8 Jun 2011 at 22:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-023
Project: Prepopulate (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple

SA-CONTRIB-2011-022 - Cosign - SQL Injection

By Drupal Security Team on 8 Jun 2011 at 17:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-022
Project: cosign (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Less critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CORE-2011-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 25 May 2011 at 18:07 UTC

Advisory ID: DRUPAL-SA-CORE-2011-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2011-May-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting

SA-CONTRIB-2011-021 - Webform - Multiple Vulnerabilities

By Drupal Security Team on 18 May 2011 at 23:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-021
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2011-May-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Multiple vulnerabilities

SA-CONTRIB-2011-020 - Taxonomy Access Control Lite (tac_lite) - Cross Site Scripting

By Drupal Security Team on 11 May 2011 at 21:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-020
Project: Taxonomy Access Control Lite (third-party module)
Version: 6.x
Date: 2011-May-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-019 - Menu Access - Cross Site Scripting

By Drupal Security Team on 4 May 2011 at 19:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-019
Project: Menu Access (third-party module)
Version: 6.x
Date: 2011-MAY-04
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-018 - Node Reference URL Widget - Cross Site Scripting

By Drupal Security Team on 27 Apr 2011 at 19:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-018
Project: Node Reference URL Widget (third-party module)
Version: 6.x, 7.x
Date: 2011-April-27
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-017 - Save Draft - Validation Bypass

By Drupal Security Team on 27 Apr 2011 at 16:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-017
Project: Save Draft (third-party module)
Version: 6.x, 7.x
Date: 2011-April-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Validation bypass

SA-CONTRIB-2011-016 - Node Quick Find - Information Disclosure

By Drupal Security Team on 6 Apr 2011 at 16:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-016
Project: Node Quick Find (third-party module)
Version: 6.x
Date: 2011-APRIL-06
Security risk: Not critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-015 - Translation Management - Multiple Vulnerabilities

By greggles on 30 Mar 2011 at 20:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-015
Project: Translation Management (third-party module)
Version: 6.x
Date: 2011-March-30
Security risk: Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgeries, SQL Injection

SA-CONTRIB-2011-014 - Webform Block - Cross Site Scripting

By mr.baileys on 23 Mar 2011 at 18:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-014
Project: Webform Block (third-party module)
Version: 6.x
Date: 2011-March-23
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-013 - Tagadelic - Cross Site Scripting (XSS)

By Drupal Security Team on 16 Mar 2011 at 19:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-013
Project: Tagadelic (third-party module)
Version: 6.x
Date: 2011-March-16
Security risk: Moderately Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-012 - Spaces - Access bypass

By Drupal Security Team on 2 Mar 2011 at 21:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-012
Project: Spaces (third-party module)
Version: 6.x
Date: 2011-March-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-011 - Secure Pages - Open redirect

By Drupal Security Team on 2 Mar 2011 at 20:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-011
Project: Secure Pages (third-party module)
Version: 6.x
Date: 2011-March-02
Security risk: Less Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Open Redirection

“Drupal security update” social engineering - PSA-2011-001

Date:

2011-February-17

Advisory ID: PSA-2011-001
Project: Drupal core and contrib
Versions: All versions
Date: 2011-February-17
Security risk: Not critical

SA-CONTRIB-2011-010 - Messaging - Cross Site Scripting

By Drupal Security Team on 16 Feb 2011 at 23:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-010
Project: Messaging (third-party module)
Version: 6.x
Date: 2011-February-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-009 - Droptor - SQL Injection

By Drupal Security Team on 2 Feb 2011 at 21:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-009
Project: Droptor (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-008 - Chatroom - Cross Site Scripting (XSS) and Cross Site Request Forgery

By Drupal Security Team on 2 Feb 2011 at 19:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-008
Project: Chatroom (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting and Cross Site Request Forgery

SA-CONTRIB-2011-007 - Userpoints Cross Site Scripting

By Drupal Security Team on 2 Feb 2011 at 19:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-007
Project: Userpoints (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-006 - Flag Page - Cross Site Scripting (XSS)

By Drupal Security Team on 2 Feb 2011 at 19:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-006
Project: Flag page (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-005 - AES encryption - Information disclosure

By Drupal Security Team on 2 Feb 2011 at 18:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-005
Project: AES (third-party module)
Version: 7.x
Date: 2011-February-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2011-004 - Multiple Vulnerabilities In Multiple Contributed Modules

By Drupal Security Team on 2 Feb 2011 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-004
Projects: Multiple third party modules - OG Forum, Open Legislation, PowerSQL
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple (Information disclosure, Cross Site Scripting, Cross Site Request Forgery, SQL injection)