Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2014-034 - Custom Search - Cross Site Scripting

By Drupal Security Team on 2 Apr 2014 at 17:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-034
Project: Custom Search (third-party module)
Version: 6.x, 7.x
Date: 2014-April-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-033 - Nivo Slider - Cross Site Scripting

By Drupal Security Team on 19 Mar 2014 at 17:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-033
Project: Nivo Slider (third-party module)
Version: 7.x
Date: 2014-March-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-032 - Xapian integration - Access Bypass

By Drupal Security Team on 19 Mar 2014 at 16:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-032
Project: Xapian integration (third-party module)
Version: 6.x, 7.x
Date: 2014-March-19
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-031 - Webform Template - Access Bypass

By Drupal Security Team on 12 Mar 2014 at 20:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-031
Project: Webform Template (third-party module)
Version: 7.x
Date: 2014-March-12
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2014-030 - SexyBookmarks - Information Disclosure

By Drupal Security Team on 12 Mar 2014 at 14:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-030
Project: SexyBookmarks (third-party module)
Version: 6.x
Date: 2014-March-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-029 - Mime Mail - Access Bypass

By Drupal Security Team on 5 Mar 2014 at 17:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-029
Project: Mime Mail (third-party module)
Version: 6.x, 7.x
Date: 2014-March-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-028 - Masquerade - Access bypass

By Drupal Security Team on 5 Mar 2014 at 17:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-028
Project: Masquerade (third-party module)
Version: 6.x, 7.x
Date: 2014-March-05
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-027 - NewsFlash Theme - XSS

By Drupal Security Team on 5 Mar 2014 at 17:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-027
Project: NewsFlash (third-party theme)
Version: 6.x, 7.x
Date: 2014-March-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-026 - Mime Mail - Access bypass

By Drupal Security Team on 26 Feb 2014 at 19:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-026
Project: Mime Mail (third-party module)
Version: 6.x, 7.x
Date: 2014-February-26
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-025 - Open Omega - Access Bypass

By Drupal Security Team on 26 Feb 2014 at 17:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-025
Project: Open Omega (third-party theme)
Version: 7.x
Date: 2014-February-26
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-024 - Content Lock - CSRF

By Drupal Security Team on 26 Feb 2014 at 16:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-024
Project: Content locking (anti-concurrent editing) (third-party module)
Version: 6.x, 7.x
Date: 2014-February-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2014-023 - Project Issue File Review - XSS

By Drupal Security Team on 26 Feb 2014 at 16:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-023
Project: Project Issue File Review (third-party module)
Version: 6.x
Date: 2014-February-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-022 - Slickgrid - Access bypass

By Drupal Security Team on 19 Feb 2014 at 15:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-022
Project: Slickgrid (third-party module)
Version: 7.x
Date: 2014-February -22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-021 - Maestro - Cross Site Scripting (XSS)

By Drupal Security Team on 19 Feb 2014 at 14:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-021
Project: Maestro (third-party module)
Version: 7.x
Date: 2014-February-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-020 - Drupal Commons - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 21:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-020
Project: Drupal Commons (third-party distribution)
Version: 7.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-019 - Easy Social - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 19:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-019
Project: Easy Social (third-party module)
Version: 7.x
Date: 2014-February-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-018 - Webform - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 16:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-018
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2014-February-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-017- Image Resize Filter - Denial of Service (DOS)

By Drupal Security Team on 12 Feb 2014 at 16:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-017
Project: Image Resize Filter (third-party module)
Version: 6.x, 7.x
Date: 2014-February-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Denial of Service (DOS)

SA-CONTRIB-2014-016 - Mayo Theme - XSS Vulnerability

By Drupal Security Team on 12 Feb 2014 at 16:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-016
Project: MAYO (third-party theme)
Version: 7.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-015 - FileField - Access Bypass

By Drupal Security Team on 12 Feb 2014 at 16:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-015
Project: FileField (third-party module)
Version: 6.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-014 - Webform Validation - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Feb 2014 at 16:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-014
Project: Webform Validation (third-party module)
Version: 6.x, 7.x
Date: 2014-February-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-013- Chaos tool suite (ctools) - Access Bypass

By Drupal Security Team on 12 Feb 2014 at 15:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-013
Project: Chaos tool suite (ctools) (third-party module)
Version: 6.x, 7.x
Date: 2014-02-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-012- Modal Frame API - Cross Site Scripting (XSS)

By Drupal Security Team on 5 Feb 2014 at 21:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-012
Project: Modal Frame API (third-party module)
Version: 6.x
Date: 2014-February-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-011 - Push Notifications - Information Disclosure

By Drupal Security Team on 5 Feb 2014 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-011
Project: Push Notifications (third-party module)
Version: 7.x
Date: 2014-February-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-010 - Services - Access Bypass and Privilege Escalation

By Drupal Security Team on 5 Feb 2014 at 15:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-010
Project: Services (third-party module)
Version: 7.x
Date: 2014-February-05
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-009 - Tagadelic - Information Disclosure

By Drupal Security Team on 3 Feb 2014 at 02:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-009
Project: Tagadelic (third-party module)
Version: 6.x
Date: 2014-February-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-008 - Tribune - Cross Site Scripting (XSS)

By Drupal Security Team on 29 Jan 2014 at 21:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-008
Project: Tribune (third-party module)
Version: 6.x, 7.x
Date: 2014-January-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-007 - Services - Multiple access bypass vulnerabilities

By Drupal Security Team on 29 Jan 2014 at 21:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-007
Project: Services (third-party module)
Version: 7.x
Date: 2014-January-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple access bypass vulnerabilities

SA-CONTRIB-2014-006 - Language Switcher Dropdown - Open Redirect

By Drupal Security Team on 22 Jan 2014 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-006
Project: Language Switcher Dropdown (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Open Redirect

SA-CONTRIB-2014-005 - Leaflet - Access bypass

By Drupal Security Team on 22 Jan 2014 at 15:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-005
Project: Leaflet (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-004 - Secure Cookie Data - Faulty Hashing

By Drupal Security Team on 22 Jan 2014 at 15:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-004
Project: Secure Cookie Data (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure, Multiple vulnerabilities

SA-CONTRIB-2014-003 - Doubleclick for Publishers DFP - Cross Site Scripting (XSS)

By Drupal Security Team on 22 Jan 2014 at 14:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-003
Project: Doubleclick for Publishers (DFP) (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2014-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 15 Jan 2014 at 19:33 UTC

Advisory ID: DRUPAL-SA-CORE-2014-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-January-15
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Jan 2014 at 15:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-002
Project: Anonymous Posting (third-party module)
Version: 7.x
Date: 2014-January-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Media - Access Bypass - PSA-2014-001

Date:

2014-January-08

Advisory ID: PSA-2014-001
Project: Media (third-party module)
Version: 7.x
Date: 2014-01-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2014-001 - Entity API - Access Bypass

By Drupal Security Team on 8 Jan 2014 at 17:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-001
Project: Entity API (third-party module)
Version: 7.x
Date: 2014-January-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-098 - Ubercart - Session Fixation Vulnerability

By Drupal Security Team on 17 Dec 2013 at 20:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-098
Project: Ubercart (third-party module)
Version: 6.x, 7.x
Date: 2013-12-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Session Fixation

SA-CONTRIB-2013-097 - OG Features - Access bypass

By Drupal Security Team on 4 Dec 2013 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-097
Project: OG Features (third-party module)
Version: 6.x
Date: 2013-December-04
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 20 Nov 2013 at 20:41 UTC

Advisory ID: DRUPAL-SA-CORE-2013-003
Project: Drupal core
Version: 6.x, 7.x
Date: 2013-November-20
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2013-096 - Entity reference - Access bypass

By Drupal Security Team on 20 Nov 2013 at 18:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-096
Project: Entity reference (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-095 - Organic Groups - Access bypass

By Drupal Security Team on 20 Nov 2013 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-095
Project: Organic groups (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-094 - EU Cookie Compliance - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Nov 2013 at 16:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-094
Project: EU Cookie Compliance (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-093 - Invitation - Access Bypass

By Drupal Security Team on 20 Nov 2013 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-093
Project: Invitation (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-092 - Misery - Denial of Service (DOS) vulnerability.

By Drupal Security Team on 13 Nov 2013 at 19:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-092
Project: Misery (third-party module)
Version: 6.x, 7.x
Date: 2013-November-13
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2013-091 - Groups, Communities and Co (GCC) - Access Bypass

By Drupal Security Team on 13 Nov 2013 at 19:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-091
Project: Groups, Communities and Co (GCC) (third-party module)
Version: 7.x
Date: 2013-November-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-090 - Revisioning - Access Bypass

By Drupal Security Team on 13 Nov 2013 at 19:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-090
Project: Revisioning (third-party module)
Version: 7.x
Date: 2013-November-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-089 - Node Access Keys - Access Bypass

By Drupal Security Team on 6 Nov 2013 at 19:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-089
Project: Node Access Keys (third-party module)
Version: 7.x
Date: 2013-November-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-088 - Secure Pages - Missing Encryption of Sensitive Data

By Drupal Security Team on 6 Nov 2013 at 19:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-088
Project: Secure Pages (third-party module)
Version: 6.x
Date: 2013-November-06
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Missing Encryption of Sensitive Data

SA-CONTRIB-2013-087 - Payment for Webform - Access Bypass

By Drupal Security Team on 6 Nov 2013 at 19:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-087
Project: Payment for Webform (third-party module)
Version: 7.x
Date: 2013-November-06
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

Direct download links available even during Drupal.org upgrade window - PSA-2013-002

Date:

2013-October-30

This is a short addition to the security announcements released on October 30th.

Due to Drupal.org's scheduled downtime on October 31, not all links in those mails may be available when you need them.

If you encounter this situation, please use the following direct URLs to the archives containing the updates.

Pages

Subscribe with RSS