Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 11 Feb 2015 at 16:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-041
Project: Feature Set (third-party module)
Version: 7.x
Date: 2015-February-11
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2015-040 - Webform prepopulate block - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Feb 2015 at 15:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-040
Project: Webform prepopulate block (third-party module)
Version: 7.x
Date: 2015-February-11
Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

SA-CONTRIB-2015-039 - Views - Multiple vulnerabilities

By Drupal Security Team on 11 Feb 2015 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-039
Project: Views (third-party module)
Version: 6.x, 7.x
Date: 2015-February-11
Security risk: 8/25 ( Less Critical) AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported

By Drupal Security Team on 4 Feb 2015 at 18:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-038
Project: Facebook Album Fetcher (third-party module)
Version: 7.x
Date: 2015-February-04
Security risk: 12/25 ( Moderately Critical) AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting

SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass

By Drupal Security Team on 4 Feb 2015 at 18:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-037
Project: Path Breadcrumbs (third-party module)
Version: 7.x
Date: 2015-February-04
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass

SA-CONTRIB-2015-036 - Public Download Count - Cross Site Scripting (XSS) - Unsupported

By Drupal Security Team on 4 Feb 2015 at 17:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-036
Project: Public Download Count (third-party module)
Version: 7.x
Date: 2015-February-04
Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

SA-CONTRIB-2015-035 - Ajax Timeline - Cross Site Scripting (XSS)

By Drupal Security Team on 4 Feb 2015 at 17:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-035
Project: Ajax Timeline (third-party module)
Version: 7.x
Date: 2015-February-04
Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

SA-CONTRIB-2015-034 - Commerce WeDeal - Open Redirect

By Drupal Security Team on 4 Feb 2015 at 17:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-034
Project: Commerce WeDeal (third-party module)
Version: 7.x
Date: 2015-February-04
Security risk: 10/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All
Vulnerability: Open Redirect

SA-CONTRIB-2015-033 - Certify - Access bypass and information disclosure

By Drupal Security Team on 28 Jan 2015 at 18:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-033
Project: Certify (third-party module)
Version: 6.x
Date: 2015-January-28
Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All
Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities

SA-CONTRIB-2015-032 - Node Invite - Multiple vulnerabilities

By Drupal Security Team on 28 Jan 2015 at 16:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-032
Project: Node Invite (third-party module)
Version: 6.x
Date: 2015-January-28
Security risk: 15/25 ( Critical) AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Open Redirect

Pages

Subscribe with RSS

SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF)

SA-CONTRIB-2015-040 - Webform prepopulate block - Cross Site Scripting (XSS)

SA-CONTRIB-2015-039 - Views - Multiple vulnerabilities

SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported

SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass

SA-CONTRIB-2015-036 - Public Download Count - Cross Site Scripting (XSS) - Unsupported

SA-CONTRIB-2015-035 - Ajax Timeline - Cross Site Scripting (XSS)

SA-CONTRIB-2015-034 - Commerce WeDeal - Open Redirect

SA-CONTRIB-2015-033 - Certify - Access bypass and information disclosure

SA-CONTRIB-2015-032 - Node Invite - Multiple vulnerabilities

Pages

News items

Our community

Documentation

Drupal code base

Governance of community