Security advisories | Drupal.org

Advisory ID: DRUPAL-SA-CONTRIB-2011-025
Project: Juitter - jQuery Twitter live search feeds and Download Count (third-party modules)
Version: 6.x
Date: 2011-June-22
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

External libraries and plugins - PSA-2011-002

Date:

2011-June-15

Advisory ID: PSA-2011-002
Date: 2011-June-15
Project: External libraries and plugins

SA-CONTRIB-2011-024 - Spam - Cross Site Request Forgery (CSFR)

By Drupal Security Team on 9 Jun 2011 at 02:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-024
Project: Spam (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2011-023 - Prepopulate - Multiple vulnerabilities

By Drupal Security Team on 8 Jun 2011 at 22:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-023
Project: Prepopulate (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple

SA-CONTRIB-2011-022 - Cosign - SQL Injection

By Drupal Security Team on 8 Jun 2011 at 17:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-022
Project: cosign (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Less critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CORE-2011-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 25 May 2011 at 18:07 UTC

Advisory ID: DRUPAL-SA-CORE-2011-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2011-May-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting

SA-CONTRIB-2011-021 - Webform - Multiple Vulnerabilities

By Drupal Security Team on 18 May 2011 at 23:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-021
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2011-May-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Multiple vulnerabilities

SA-CONTRIB-2011-020 - Taxonomy Access Control Lite (tac_lite) - Cross Site Scripting

By Drupal Security Team on 11 May 2011 at 21:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-020
Project: Taxonomy Access Control Lite (third-party module)
Version: 6.x
Date: 2011-May-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-019 - Menu Access - Cross Site Scripting

By Drupal Security Team on 4 May 2011 at 19:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-019
Project: Menu Access (third-party module)
Version: 6.x
Date: 2011-MAY-04
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-018 - Node Reference URL Widget - Cross Site Scripting

By Drupal Security Team on 27 Apr 2011 at 19:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-018
Project: Node Reference URL Widget (third-party module)
Version: 6.x, 7.x
Date: 2011-April-27
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-017 - Save Draft - Validation Bypass

By Drupal Security Team on 27 Apr 2011 at 16:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-017
Project: Save Draft (third-party module)
Version: 6.x, 7.x
Date: 2011-April-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Validation bypass

SA-CONTRIB-2011-016 - Node Quick Find - Information Disclosure

By Drupal Security Team on 6 Apr 2011 at 16:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-016
Project: Node Quick Find (third-party module)
Version: 6.x
Date: 2011-APRIL-06
Security risk: Not critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-015 - Translation Management - Multiple Vulnerabilities

By greggles on 30 Mar 2011 at 20:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-015
Project: Translation Management (third-party module)
Version: 6.x
Date: 2011-March-30
Security risk: Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgeries, SQL Injection

SA-CONTRIB-2011-014 - Webform Block - Cross Site Scripting

By mr.baileys on 23 Mar 2011 at 18:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-014
Project: Webform Block (third-party module)
Version: 6.x
Date: 2011-March-23
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-013 - Tagadelic - Cross Site Scripting (XSS)

By Drupal Security Team on 16 Mar 2011 at 19:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-013
Project: Tagadelic (third-party module)
Version: 6.x
Date: 2011-March-16
Security risk: Moderately Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-012 - Spaces - Access bypass

By Drupal Security Team on 2 Mar 2011 at 21:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-012
Project: Spaces (third-party module)
Version: 6.x
Date: 2011-March-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-011 - Secure Pages - Open redirect

By Drupal Security Team on 2 Mar 2011 at 20:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-011
Project: Secure Pages (third-party module)
Version: 6.x
Date: 2011-March-02
Security risk: Less Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Open Redirection

“Drupal security update” social engineering - PSA-2011-001

Date:

2011-February-17

Advisory ID: PSA-2011-001
Project: Drupal core and contrib
Versions: All versions
Date: 2011-February-17
Security risk: Not critical

SA-CONTRIB-2011-010 - Messaging - Cross Site Scripting

By Drupal Security Team on 16 Feb 2011 at 23:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-010
Project: Messaging (third-party module)
Version: 6.x
Date: 2011-February-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-009 - Droptor - SQL Injection

By Drupal Security Team on 2 Feb 2011 at 21:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-009
Project: Droptor (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-008 - Chatroom - Cross Site Scripting (XSS) and Cross Site Request Forgery

By Drupal Security Team on 2 Feb 2011 at 19:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-008
Project: Chatroom (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting and Cross Site Request Forgery

SA-CONTRIB-2011-007 - Userpoints Cross Site Scripting

By Drupal Security Team on 2 Feb 2011 at 19:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-007
Project: Userpoints (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-006 - Flag Page - Cross Site Scripting (XSS)

By Drupal Security Team on 2 Feb 2011 at 19:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-006
Project: Flag page (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-005 - AES encryption - Information disclosure

By Drupal Security Team on 2 Feb 2011 at 18:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-005
Project: AES (third-party module)
Version: 7.x
Date: 2011-February-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2011-004 - Multiple Vulnerabilities In Multiple Contributed Modules

By Drupal Security Team on 2 Feb 2011 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-004
Projects: Multiple third party modules - OG Forum, Open Legislation, PowerSQL
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple (Information disclosure, Cross Site Scripting, Cross Site Request Forgery, SQL injection)

SA-CONTRIB-2011-003 - Janrain Engage (RPX) - Multiple Vulnerabilities

By Drupal Security Team on 19 Jan 2011 at 22:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-003
Project: Janrain Engage (formerly RPX) (third-party module)
Version: 6.x
Date: 2011-January-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting or Arbitrary Code Execution

SA-CONTRIB-2011-002 - Panels - Cross Site Scripting (XSS)

By Drupal Security Team on 13 Jan 2011 at 01:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-002
Project: Panels (third-party module)
Version: 6.x
Date: 2011-January-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-001 - Webform - SQL Injection

By Drupal Security Team on 10 Jan 2011 at 10:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-001
Project: Webform (third-party module)
Version: 6.x
Date: 2011-January-10
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2010-113 - Image - Cross Site Scripting

By Drupal Security Team on 22 Dec 2010 at 21:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-113
Project: Image (third-party module)
Version: 5.x, 6.x
Date: 2010-December-22
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-112 - oEmbed - Access Bypass

By Drupal Security Team on 22 Dec 2010 at 21:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-112
Project: oEmbed (third-party module)
Version: 6.x
Date: 2010-December-22
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-111 - Views - Cross Site Scripting

By Drupal Security Team on 15 Dec 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-111
Project: Views (third-party module)
Version: 6.x
Date: 2010-December-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-110 - Drupal For Firebug - Cross-site Request Forgery

By Drupal Security Team on 15 Dec 2010 at 19:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-110
Project: Drupal For Firebug (third-party module)
Version: 5.x, 6.x
Date: 2010-Dec-15
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-109 - Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam - Multiple Vulnerabilities

By Drupal Security Team on 8 Dec 2010 at 22:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-109
Projects: Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam (third-party module)
Version: 5.x and 6.x
Date: 2010-December-08
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities