Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

High-performance JavaScript callback handler - Highly Critical - Multiple vulnerabilities - SA-CONTRIB-2016-063

By Drupal Security Team on 7 Dec 2016 at 17:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-063
Project: High-performance JavaScript callback handler (third-party module)
Version: 7.x
Date: 2016-December-07
Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting, Access bypass, Cross Site Request Forgery, Open Redirect, Multiple vulnerabilities

Elysia Cron - Critical - Arbitrary PHP code execution - SA-CONTRIB-2016-062

By Drupal Security Team on 30 Nov 2016 at 19:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-062
Project: Elysia Cron (third-party module)
Version: 7.x
Date: 2016-November-30
Security risk: 11/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: Arbitrary PHP code execution

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005

By Drupal Security Team on 16 Nov 2016 at 17:37 UTC

Advisory ID: DRUPAL-SA-CORE-2016-005
Project: Drupal core
Version: 7.x, 8.x
Date: 2016-November-16
Security risk: 13/25 ( Moderately Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Multiple vulnerabilities

Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061

By Drupal Security Team on 9 Nov 2016 at 18:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-061
Project: Views Send (third-party module)
Version: 7.x
Date: 2016-November-09
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Workbench Moderation - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-060

By Drupal Security Team on 2 Nov 2016 at 20:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-060
Project: Workbench Moderation (third-party module)
Version: 7.x
Date: 2016-November-02
Security risk: 11/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Information Disclosure

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

By Drupal Security Team on 2 Nov 2016 at 19:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-059
Project: D8 Editor File upload (third-party module)
Version: 8.x
Date: 2016-November-02
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability:

Bootstrap - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-058

By Drupal Security Team on 2 Nov 2016 at 18:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-058
Project: Bootstrap (third-party theme)
Version: 7.x
Date: 2016-November-02
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting

Profile 2 Registration Path - Critical - Cross Site Scripting (XSS) and Access Bypass DRUPAL-SA-CONTRIB-2015-057

By Drupal Security Team on 2 Nov 2016 at 17:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-057
Project: Profile2 Registration Path (third-party module)
Version: 7.x
Date: 2016-November-02
Security risk: 19/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Proof/TD:All
Vulnerability: Access bypass

Like/Dislike - Critical - Cross Site Request Forgery - SA-CONTRIB-2016-056

By Drupal Security Team on 2 Nov 2016 at 17:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-056
Project: Like/Dislike (third-party module)
Version: 8.x
Date: 2016-November-02
Security risk: 15/25 ( Moderately Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Cross Site Request Forgery

Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055

By Drupal Security Team on 2 Nov 2016 at 17:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-055
Project: Menu Views (third-party module)
Version: 7.x
Date: 2016-November-02
Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS

High-performance JavaScript callback handler - Highly Critical - Multiple vulnerabilities - SA-CONTRIB-2016-063

Elysia Cron - Critical - Arbitrary PHP code execution - SA-CONTRIB-2016-062

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005

Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061

Workbench Moderation - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-060

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

Bootstrap - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-058

Profile 2 Registration Path - Critical - Cross Site Scripting (XSS) and Access Bypass DRUPAL-SA-CONTRIB-2015-057

Like/Dislike - Critical - Cross Site Request Forgery - SA-CONTRIB-2016-056

Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055

Pages

News items

Our community

Documentation

Drupal code base

Governance of community