Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2010-027: Email Input Filter - Arbitrary code execution

By Drupal Security Team on 17 Mar 2010 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-027
Project: Email Input Filter (third-party module)
Version: 5.x, 6.x
Date: 2010-March-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-026 - Monthly Archive by Node Type - Access Bypass

By Drupal Security Team on 10 Mar 2010 at 16:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-026
Project: Monthly Archive by Node Type (third-party module)
Version: 6.x (all branches)
Date: 2010-March-10
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-025 - TinyMCE - Cross Site Scripting (XSS)

By greggles on 10 Mar 2010 at 14:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-025
Project: TinyMCE (third-party module)
Version: 5.x
Date: 2010-March-09
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2010-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 3 Mar 2010 at 19:31 UTC

Advisory ID: DRUPAL-SA-CORE-2010-001
Project: Drupal core
Version: 5.x, 6.x
Date: 2010-March-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Open redirect, Authorization vulnerability

SA-CONTRIB-2010-024 - eTracker - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 19:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-024
Project: eTracker (third-party module)
Version: 6.x-1.1
Date: 2010-March-03
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-023 - Workflow - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 18:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-023
Project: Workflow (third-party module)
Version: 6.x, 5.x
Date: 2010-March-03
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-022 - Internationalization - Arbitrary code execution

By Drupal Security Team on 3 Mar 2010 at 18:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-022
Project: Internationalization (third-party module)
Version: 6.x-1.x 5.x-2.x
Date: 2010-March-03
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-021 - AddThis Button - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 17:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-021
Project: AddThis Button (third-party module)
Version: 6.x, 5.x
Date: 2010-March-03
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-020 - Facebook-style Statuses (Microblog) - Access bypass

By Drupal Security Team on 24 Feb 2010 at 22:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-020
Project: Facebook-style Statuses (Microblog) (third-party module)
Version: 6.x-2.x
Date: 2010-February-24
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2010-019 - Weekly Archive by Node Type - Access Bypass

By Drupal Security Team on 24 Feb 2010 at 16:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-019
Project: Weekly Archive by Node Type (third-party module)
Version: 6.x-2.x
Date: 2010-February-24
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-018 - Content Distribution - Multiple Vulnerabilities

By Drupal Security Team on 17 Feb 2010 at 22:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-018
Project: Content Distribution (third-party module)
Version: 6.x
Date: 2010 February 17
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Mulitple Vulnerabilities

SA-CONTRIB-2010-017 - iTweak Upload - Cross Site Scripting

By Drupal Security Team on 17 Feb 2010 at 18:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-017
Project: iTweak Upload (third-party module)
Version: 6.x
Date: 2010 February 17
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-016 - Graphviz Filter - arbitrary code execution

By Drupal Security Team on 10 Feb 2010 at 23:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-016
Project: Graphviz Filter (third-party module)
Version: 6.x, 5.x
Date: 2010 February 10
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-015 - Signwriter - Arbitrary code execution

By Drupal Security Team on 3 Feb 2010 at 20:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-015
Project: Signwriter (third-party module)
Version: 5.x, 6.x
Date: 2010-February-3
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-014 - Node Export - Arbitrary code execution

By Drupal Security Team on 3 Feb 2010 at 19:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-014
Project: Node Export (third-party module)
Version: 5.x, 6.x
Date: 2010-February-3
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-013 - Menu Breadcrumb - Cross site scripting

By Drupal Security Team on 3 Feb 2010 at 16:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-013
Project: Menu Breadcrumb (third-party module)
Version: 6.x
Date: 2010-February-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-012 - ODF Import - Access Bypass (possible Cross Site Scripting)

By greggles on 3 Feb 2010 at 15:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-012
Project: ODF Import (third-party module)
Version: 6.x-1.0
Date: 2010-February-3
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-011 - Feedback - Cross Site Scripting

By Drupal Security Team on 27 Jan 2010 at 22:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-011
Project: Feedback (third-party module)
Version: 5.x, 6.x
Date: 2010-January-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-010 - Author Contact - Cross site scripting

By coltrane on 27 Jan 2010 at 20:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-010
Project: Author Contact (third-party module)
Version: 5.x, 6.x
Date: 2010-January-27
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-009 - Block Class - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-009
Project: Block Class (third-party module)
Version: 6.x-1.2, 5.x-1.1
Date: 2010-January-20
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-008 - Recent Comments - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-008
Project: Recent Comments (third-party module)
Version: 6.x-1.0, 5.x-1.2
Date: 2010-January-20
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-007 - Control Panel - Cross Site Scripting

By Drupal Security Team on 20 Jan 2010 at 18:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-007
Project: Control Panel (third-party module)
Version: 5.x, 6.x
Date: 2010-January-20
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-006 - Bibliography Module - Cross Site Scripting

By Drupal Security Team on 13 Jan 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-006
Project: Bibliography (third-party module)
Version: 5.x, 6.x
Date: 2010-January-13
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-005 - Own Term - Cross site scripting

By coltrane on 13 Jan 2010 at 17:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-005
Project: Own Term (third-party module)
Version: 6.x-1.0
Date: 2010-January-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-004 - Node block - Cross site scripting

By Drupal Security Team on 13 Jan 2010 at 17:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-004
Project: Node Block (third-party module)
Version: 6.13, 5.11
Date: 2010-January-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-003 - Forward - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 23:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-003
Project: Forward (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple XSS vulnerabilities

SA-CONTRIB-2010-002 - Currency Exchange - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 19:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-002
Project: Currency Exchange (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-001 - Wunderbar - Cross Site Scripting

By Drupal Security Team on 6 Jan 2010 at 19:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-001
Project: Wunderbar! (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-115 - Autocomplete Widgets for CCK Text and Number - Information Disclosure

By Drupal Security Team on 30 Dec 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-115
Project: Autocomplete Widgets for CCK Text and Number (third-party module)
Version: 6.x
Date: 2009-December-30
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2009-114 - Automated Logout - Cross Site Scripting

By Drupal Security Team on 24 Dec 2009 at 03:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-114
Project: Automated Logout (third-party module)
Version: 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-113 - FAQ - Cross Site Scripting

By Drupal Security Team on 23 Dec 2009 at 18:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-113
Project: FAQ (third-party module)
Version: 5.x, 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2009-009 - Drupal Core - Cross site scripting

By Drupal Security Team on 16 Dec 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CORE-2009-009
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-112 - Sections - Cross Site Scripting

By Drupal Security Team on 16 Dec 2009 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-112
Project: Sections (third-party module)
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-111 - Randomizer - Cross Site Scripting

By Drupal Security Team on 9 Dec 2009 at 21:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-111
Project: Randomizer (third-party module)
Version: 5.x, 6.x
Date: 2009-December-09
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-110 - Taxonomy Timer - SQL Injection

By Drupal Security Team on 2 Dec 2009 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-110
Project: Taxonomy Timer (third-party module)
Version: 5.x, 6.x
Date: 2009-November-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2009-109 - Printfriendly - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 22:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-109
Project: Printfriendly (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-108 - Gallery Assist - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 22:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-108
Project: Gallery Assist (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-107 - Ubercart - Access bypass, Cross site request forgery

By Drupal Security Team on 18 Nov 2009 at 20:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-107
Project: Ubercart (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross-site request forgery

Description

Ubercart's PayPal Website Payments Standard integration exposes a path for completed orders without properly checking that the order is valid for the current user. In the event that the order has already been processed for checkout, this can result in duplicate actions taking place inadvertently. Furthermore, if the checkout completion message has been modified to include order details, information disclosure can happen.

The Ubercart order management was also affected by a minor cross-site request forgery vulnerability.

Versions affected

Ubercart module for Drupal 6.x prior to Ubercart 6.x-2.1
Ubercart module for Drupal 5.x prior to Ubercart 5.x-1.9

Drupal core is not affected. If you do not use the contributed Ubercart module, there is nothing you need to do.

Solution

Upgrade to the latest version:

SA-CONTRIB-2009-106 - Agreement - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-106
Project: Agreement (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-105 - Subgroups for Organic Groups - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 20:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-105
Project: Subgroups for Organic Groups (third-party module)
Version: 5.x
Date: 2009-November-18
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-104 - Feed Element Mapper - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 19:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-104
Project: Feed Element Mapper (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-103 - Strongarm - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 18:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-103
Project: Strongarm (third-party module)
Version: 6.x
Date: 2009 November 18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-102 - PHPList Integration Module - Cross Site Request Forgery

By pwolanin on 18 Nov 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-102
Project: PHPList Inegration Module (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-CONTRIB-2009-101 - Web Services - Access Bypass

By Drupal Security Team on 11 Nov 2009 at 22:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-101
Project: Web Services (third-party theme)
Version: 6.x
Date: 2009-November-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-100 - AddToAny - Cross Site Scripting

By undefined on 11 Nov 2009 at 22:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-100
Project: AddToAny (third-party module)
Version: 5.x, 6.x
Date: 2009 November 11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-099 - RootCandy Theme - Cross Site Scripting

By meba on 11 Nov 2009 at 21:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-099
Project: RootCandy (third-party theme)
Version: 6.x
Date: 2009-November-11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-098 - Zoomify - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 22:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-098
Project: Zoomify (third-party module)
Version: 5.x, 6.x
Date: 2009-November-4
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-097 - Organic Groups Vocabulary - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 22:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-097
Project: Organic Groups Vocabulary (third-party module)
Version: 6.x
Date: 2009-November-4
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-096 - Link - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 20:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-096
Project: Link (third-party module)
Version: 5.x, 6.x
Date: 2009-November-4
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass

By Drupal Security Team on 4 Nov 2009 at 20:02 UTC

Advisory ID: SA-CONTRIB-2009-095
Project: Smartqueues for Organic Groups (smartqueue_og) (third-party module)
Version: 6.x
Date: 2009 November 4
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

Pages

Subscribe with RSS