Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2011-052 - Views SQL Injection

By Drupal Security Team on 2 Nov 2011 at 22:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-052
Project: Views (third-party module)
Version: 6.x
Date: 2011-November-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-051 - Hotblocks module - multiple vulnerabilities

By Drupal Security Team on 2 Nov 2011 at 19:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-051
Project: HotBlocks (third-party module)
Version: 6.x
Date: 2011-November-02
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2011-050 - Organic groups - Access bypass

By Drupal Security Team on 26 Oct 2011 at 15:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-050
Project: Organic groups (third-party module)
Version: 7.x
Date: 2011-October-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-049 - Cumulus - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Oct 2011 at 16:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-049
Project: Cumulus (third-party module)
Version: 5.x, 6.x
Date: 2011-October-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2011-048 - Certificate Login SQL Injection

By Drupal Security Team on 12 Oct 2011 at 16:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-048
Project: Certificate Login (third-party module)
Version: 5.x, 6.x
Date: 2011-October-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-047 - OG Features access bypass

By Drupal Security Team on 5 Oct 2011 at 19:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-047
Project: OG Features (third-party module)
Version: 6.x
Date: 2011-October-05
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-046 - Echo - Multiple Vulnerabilities

By Drupal Security Team on 5 Oct 2011 at 18:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-046
Project: Echo (third-party module)
Version: 6.x, 7.x, 8.x
Date: 2011-October-05
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2011-045 - Rate module Cross Site Scripting

By Drupal Security Team on 5 Oct 2011 at 17:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-045
Project: Rate (third-party module)
Version: 6.x, 7.x
Date: 2011-October-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2011-044 - Homebox for Organic Groups Cross Site Scripting

By Drupal Security Team on 5 Oct 2011 at 17:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-044
Project: Homebox (third-party module)
Version: 6.x, 7.x
Date: 2011-October-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2011-043 - Petition Node - Cross Site Scripting

By Drupal Security Team on 5 Oct 2011 at 13:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-043
Project: petition_node (third-party module)
Version: 6.x
Date: 2011-October-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-042 Views Bulk Operations - Cross Site Scripting

By Drupal Security Team on 21 Sep 2011 at 21:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-042
Project: Views Bulk Operations (VBO) (third-party module)
Version: 6.x
Date: 2011-September-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-041 - Hostmaster (Aegir) - Cross Site Scripting

By Drupal Security Team on 21 Sep 2011 at 16:43 UTC

Advisory ID: SA-CONTRIB-2011-041
Project: Hostmaster (Aegir) (third-party module)
Version: 6.x
Date: 2011-September-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-040 Author Pane access bypass

By Drupal Security Team on 7 Sep 2011 at 14:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-040
Project: Author Pane (third-party module)
Version: 6.x
Date: 2011-September-7
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities

By Drupal Security Team on 31 Aug 2011 at 17:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-039
Project: Bot Alarm (third-party module)
Version: 6.x
Date: 2011-August-31
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2011-038 - Taxonomy Views Integrator - Cross Site Scripting

By Drupal Security Team on 31 Aug 2011 at 13:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-038
Project: Taxonomy Views Integrator (third-party module)
Version: 6.x
Date: 2011-August-31
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-037- Node Invite - Cross Site Scripting

By Drupal Security Team on 31 Aug 2011 at 13:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-037
Project: Node Invite (third-party module)
Version: 6.x
Date: 2011-August-31
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-036 - Addresses - Cross Site Scripting

By Drupal Security Team on 17 Aug 2011 at 17:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-036
Project: Addresses (third-party module)
Version: 6.x
Date: 2011-August-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-035 Forward module - Open redirect

By Drupal Security Team on 17 Aug 2011 at 17:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-035
Project: Forward (third-party module)
Version: 6.x, 7.x
Date: 2011-August-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Open redirect

SA-CONTRIB-2011-034 - Display Suite - Cross Site Scripting

By Drupal Security Team on 3 Aug 2011 at 19:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-034
Project: Display suite (third-party module)
Version: 7.x
Date: 2011-August-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-033 - iWebkit - Cross Site Scripting

By Drupal Security Team on 3 Aug 2011 at 19:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-033
Project: iWebkit (third-party module)
Version: 6.x
Date: 2011-August-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-032 - Mail Logger - Cross Site Scripting

By Drupal Security Team on 3 Aug 2011 at 16:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-032
Project: Mail Logger (third-party module)
Version: 6.x
Date: 2011-August-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2011-003 - Drupal core - Access bypass

By Drupal Security Team on 27 Jul 2011 at 19:32 UTC

Advisory ID: DRUPAL-SA-CORE-2011-003
Project: Drupal core
Version: 7.x
Date: 2011-July-27
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-031 - SunMailer - Access bypass

By Drupal Security Team on 20 Jul 2011 at 20:18 UTC

Advisory ID: SA-CONTRIB-2011-031
Project: SunMailer Newsletter (third-party module)
Version: 6.x
Date: 2011-July-20
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-030 - Devel - Cross Site Request Forgery

By Drupal Security Team on 20 Jul 2011 at 20:04 UTC

Advisory ID: SA-CONTRIB-2011-030
Project: Devel (third-party module)
Version: 6.x, 7.x
Date: 2011-July-20
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2011-029 - Taxonomy Filter - Cross Site Scripting

By Drupal Security Team on 20 Jul 2011 at 15:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-029
Project: Taxonomy Filter (third-party module)
Version: 6.x, 7.x
Date: 2011-July-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-028 - Simple Clean - Cross Site Scripting

By Drupal Security Team on 6 Jul 2011 at 19:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-028
Project: Simple Clean (third-party module)
Version: 7.x
Date: 2011-July-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-027 -Facebook Share - Cross Site Scripting (XSS)

By Drupal Security Team on 6 Jul 2011 at 14:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-027
Project: Facebook Share (third-party module)
Version: 6.x, 7.x
Date: 2011-July-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2011-002 - Drupal core - Access bypass

By Drupal Security Team on 30 Jun 2011 at 00:13 UTC

Advisory ID: DRUPAL-SA-CORE-2011-002
Project: Drupal core
Version: 7.x
Date: 2011-JUNE-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-026 - Secure Password Hashes (phpass) - Multiple Vulnerabilities

By pwolanin on 29 Jun 2011 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-026
Project: Secure Password Hashes (phpass) (third-party module)
Version: 5.x, 6.x
Date: 2011-June-29
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2011-025 - Juitter & Download Count - Cross Site Scripting (XSS)

By Drupal Security Team on 22 Jun 2011 at 15:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-025
Project: Juitter - jQuery Twitter live search feeds and Download Count (third-party modules)
Version: 6.x
Date: 2011-June-22
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

External libraries and plugins - PSA-2011-002

Date:

2011-June-15

Advisory ID: PSA-2011-002
Date: 2011-June-15
Project: External libraries and plugins

SA-CONTRIB-2011-024 - Spam - Cross Site Request Forgery (CSFR)

By Drupal Security Team on 9 Jun 2011 at 02:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-024
Project: Spam (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2011-023 - Prepopulate - Multiple vulnerabilities

By Drupal Security Team on 8 Jun 2011 at 22:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-023
Project: Prepopulate (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple

SA-CONTRIB-2011-022 - Cosign - SQL Injection

By Drupal Security Team on 8 Jun 2011 at 17:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-022
Project: cosign (third-party module)
Version: 6.x
Date: 2011-June-08
Security risk: Less critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CORE-2011-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 25 May 2011 at 18:07 UTC

Advisory ID: DRUPAL-SA-CORE-2011-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2011-May-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting

SA-CONTRIB-2011-021 - Webform - Multiple Vulnerabilities

By Drupal Security Team on 18 May 2011 at 23:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-021
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2011-May-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Multiple vulnerabilities

SA-CONTRIB-2011-020 - Taxonomy Access Control Lite (tac_lite) - Cross Site Scripting

By Drupal Security Team on 11 May 2011 at 21:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-020
Project: Taxonomy Access Control Lite (third-party module)
Version: 6.x
Date: 2011-May-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-019 - Menu Access - Cross Site Scripting

By Drupal Security Team on 4 May 2011 at 19:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-019
Project: Menu Access (third-party module)
Version: 6.x
Date: 2011-MAY-04
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-018 - Node Reference URL Widget - Cross Site Scripting

By Drupal Security Team on 27 Apr 2011 at 19:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-018
Project: Node Reference URL Widget (third-party module)
Version: 6.x, 7.x
Date: 2011-April-27
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-017 - Save Draft - Validation Bypass

By Drupal Security Team on 27 Apr 2011 at 16:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-017
Project: Save Draft (third-party module)
Version: 6.x, 7.x
Date: 2011-April-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Validation bypass

SA-CONTRIB-2011-016 - Node Quick Find - Information Disclosure

By Drupal Security Team on 6 Apr 2011 at 16:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-016
Project: Node Quick Find (third-party module)
Version: 6.x
Date: 2011-APRIL-06
Security risk: Not critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-015 - Translation Management - Multiple Vulnerabilities

By greggles on 30 Mar 2011 at 20:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-015
Project: Translation Management (third-party module)
Version: 6.x
Date: 2011-March-30
Security risk: Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgeries, SQL Injection

SA-CONTRIB-2011-014 - Webform Block - Cross Site Scripting

By mr.baileys on 23 Mar 2011 at 18:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-014
Project: Webform Block (third-party module)
Version: 6.x
Date: 2011-March-23
Security risk: Moderately critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-013 - Tagadelic - Cross Site Scripting (XSS)

By Drupal Security Team on 16 Mar 2011 at 19:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-013
Project: Tagadelic (third-party module)
Version: 6.x
Date: 2011-March-16
Security risk: Moderately Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-012 - Spaces - Access bypass

By Drupal Security Team on 2 Mar 2011 at 21:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-012
Project: Spaces (third-party module)
Version: 6.x
Date: 2011-March-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2011-011 - Secure Pages - Open redirect

By Drupal Security Team on 2 Mar 2011 at 20:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-011
Project: Secure Pages (third-party module)
Version: 6.x
Date: 2011-March-02
Security risk: Less Critical (definition of risk levels)
Exploitable from: Remote
Vulnerability: Open Redirection

“Drupal security update” social engineering - PSA-2011-001

Date:

2011-February-17

Advisory ID: PSA-2011-001
Project: Drupal core and contrib
Versions: All versions
Date: 2011-February-17
Security risk: Not critical

SA-CONTRIB-2011-010 - Messaging - Cross Site Scripting

By Drupal Security Team on 16 Feb 2011 at 23:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-010
Project: Messaging (third-party module)
Version: 6.x
Date: 2011-February-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-009 - Droptor - SQL Injection

By Drupal Security Team on 2 Feb 2011 at 21:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-009
Project: Droptor (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2011-008 - Chatroom - Cross Site Scripting (XSS) and Cross Site Request Forgery

By Drupal Security Team on 2 Feb 2011 at 19:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-008
Project: Chatroom (third-party module)
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting and Cross Site Request Forgery

Pages

Subscribe with RSS