Security advisories for third-party projects that are not part of Drupal core - this includes all modules, themes, and installation profiles that have been contributed by a community member. These posts by the Drupal security team are also sent to the security announcements e-mail list.

SA-CONTRIB-2012-016 - Forward module CSRF and Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-016
  • Project: Forward (third-party module)
  • Version: 6.x, 7.x
  • Date: 2012-February-01
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass, Cross Site Request Forgery

SA-CONTRIB-2012-015 - Managesite - Cross Site Scripting (XSS)

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-015
  • Project: Managesite (third-party module)
  • Version: 6.x
  • Date: 2012-January-25
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-014 - Drupal Commerce - Cross Site Scripting (XSS)

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-014
  • Project: Drupal Commerce (third-party module)
  • Version: 7.x
  • Date: 2012-January-25
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-013 - Search Autocomplete - SQL Injection

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-013
  • Project: Search Autocomplete (third-party module)
  • Version: 7.x
  • Date: 2012-January-25
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: SQL Injection

SA-CONTRIB-2012-012 - Quicktabs - Cross Site Scripting (XSS)

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-012
  • Project: Quick Tabs (third-party module)
  • Version: 6.x, 7.x
  • Date: 2012-January-18
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-011 - Panels - Cross Site Scripting (XSS)

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-011
  • Project: Panels (third-party module)
  • Version: 6.x
  • Date: 2012-January-18
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-010 - stickynote - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-010
  • Project: stickynote (third-party module)
  • Version: 7.x
  • Date: 2012-January-17
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-009 - Revisioning - Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-009
  • Project: Revisioning (third-party module)
  • Version: 7.x
  • Date: 2012-January-18
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2012-008 - Video Filter - Cross Site Scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-008
  • Project: Video Filter (third-party module)
  • Version: 6.x, 7.x
  • Date: 2012-JANUARY-11
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-007 - Password Policy - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2012-007
  • Project: Password policy (third-party module)
  • Version: 6.x
  • Date: 2012-January-11
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting, Cross Site Request Forgery

Pages

Subscribe with RSS Subscribe to Security advisories for contributed projects