Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

DRUPAL-SA-2006-005 - Drupal core - SQL injection vulnerability

By chx on 24 May 2006 at 19:42 UTC

Advisory ID: DRUPAL-SA-2006-005
Project: Drupal core
Date: 2006-May-18
Security risk: highly critical
Impact: Drupal core
Exploitable from: remote
Vulnerability: SQL injection

XSS vulnerability in project module

By dries on 8 May 2006 at 09:09 UTC

Project: project module (contributed module)
Security risk: less critical
Impact: project module
Where: from remote
Vulnerability: malicious HTML execution and XSS attacks

DRUPAL-SA-2006-004 Mail header injection vulnerability

By jvandyk on 13 Mar 2006 at 21:04 UTC

Advisory ID: DRUPAL-SA-2006-004
Project: Drupal core
Date: 2006-03-13
Security risk: moderately critical
Impact: security bypass
Where: from remote
Vulnerability: mail header injection attack

DRUPAL-SA-2006-003 Session fixation vulnerability

By jvandyk on 13 Mar 2006 at 21:00 UTC

Advisory ID: DRUPAL-SA-2006-003
Project: Drupal core
Date: 2006-03-13
Security risk: less critical
Impact: hijacking
Where: from remote
Vulnerability: session fixation attack

DRUPAL-SA-2006-002 XSS vulnerabilities

By jvandyk on 13 Mar 2006 at 20:45 UTC

Advisory ID: DRUPAL-SA-2006-002
Project: Drupal core
Date: 2006-03-13
Security risk: less critical
Impact: cross-site scripting
Where: from remote
Vulnerability: cross-site scripting

DRUPAL-SA-2006-001 Security bypass in menu.module

By jvandyk on 13 Mar 2006 at 20:21 UTC

Advisory ID: DRUPAL-SA-2006-001
Project: Drupal core
Date: 2006-03-13
Security risk: less critical
Impact: security bypass
Where: from remote
Vulnerability: bypass access control

False Drupal XSS alarm on BugTraq - PSA-2006-001

Date:

2006-January-04

Someone under the pseudonym "Liz0ziM" sent a false security alarm to BugTraq without first contacting the security team:

http://www.securityfocus.com/archive/1/420671/30/0/threaded

This vulnerability is fixed in Drupal 4.5.6, 4.6.4 and onwards. Drupal's new XSS filter mechanism takes care of all vulnerabilities listed on http://ha.ckers.org/xss.html (and even more).

DRUPAL-SA-2005-009 Bypass "view user profiles" permission

By dries on 30 Nov 2005 at 21:45 UTC

Advisory ID: DRUPAL-SA-2005-009
Project: Drupal core
Date: 2005-11-30
Security risk: not critical
Impact: normal
Where: from remote
Vulnerability: bypass access control

DRUPAL-SA-2005-008 XSS and HTTP header injection vulnerability with uploaded files

By dries on 30 Nov 2005 at 21:45 UTC

Advisory ID: DRUPAL-SA-2005-008
Project: Drupal core
Date: 2005-11-30
Security risk: less critical
Impact: normal
Where: from remote
Vulnerability: XSS, HTTP header injection

DRUPAL-SA-2005-007 XSS vulnerability in submitted content

By dries on 30 Nov 2005 at 21:45 UTC

Advisory ID: DRUPAL-SA-2005-007
Project: Drupal core
Date: 2005-11-30
Security risk: less critical
Impact: normal
Where: from remote
Vulnerability: XSS

Pages

Subscribe with RSS