Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2013-086 - Monster Menus - Access bypass

By Drupal Security Team on 30 Oct 2013 at 18:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-086
Project: Monster Menus (third-party module)
Version: 7.x
Date: 2013-October-30
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-085 - Feed Element Mapper - Cross Site Scripting

By Drupal Security Team on 30 Oct 2013 at 18:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-085
Project: Feed Element Mapper (third-party module)
Version: 6.x
Date: 2013-October-30
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-084 - FileField Sources - Access Bypass

By Drupal Security Team on 30 Oct 2013 at 18:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-084
Project: FileField Sources (third-party module)
Version: 6.x, 7.x
Date: 2013-October-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-083 - Quiz - Access Bypass

By Drupal Security Team on 30 Oct 2013 at 14:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-083
Project: Quiz (third-party module)
Version: 6.x
Date: 2013-October-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities

SA-CONTRIB-2013-082 - Bean - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Oct 2013 at 18:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-082
Project: Bean (third-party module)
Version: 7.x
Date: 2013-10-23
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-081 - Spaces - Access bypass

By Drupal Security Team on 23 Oct 2013 at 16:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-081
Project: Spaces (third-party module)
Version: 6.x
Date: 2013-10-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-080 - Simplenews - Cross Site Scripting (XSS)

By Drupal Security Team on 16 Oct 2013 at 18:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-080
Project: Simplenews (third-party module)
Version: 6.x, 7.x
Date: 2013-Month-DD
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-079 - Context - Multiple Vulnerabilities

By Drupal Security Team on 16 Oct 2013 at 15:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-079
Project: Context (third-party module)
Version: 6.x, 7.x
Date: 2013-2013-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass, Arbitrary PHP code execution

SA-CONTRIB-2013-078 - Quick Tabs - Access Bypass

By Drupal Security Team on 2 Oct 2013 at 17:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-078
Project: Quick Tabs (third-party module)
Version: 6.x, 7.x
Date: 2013-October-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-077 - Google Site Search - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Sep 2013 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-077
Project: Google Site Search (third-party module)
Version: 6.x, 7.x
Date: 2013-September-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-076 - jQuery Countdown - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Sep 2013 at 21:15 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-076
Project: jQuery Countdown (third-party module)
Version: 7.x
Date: 2013-September-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-075 - Click2Sell - Multiple Vulnerabilities (XSS and CSRF)

By Drupal Security Team on 11 Sep 2013 at 20:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-075
Project: Click2Sell Suite (third-party module)
Version: 6.x
Date: 2013-September-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2013-074 - MediaFront - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Sep 2013 at 20:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-074
Project: MediaFront (third-party module)
Version: 6.x, 7.x
Date: 2013-September-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Drupal core - Users can insert hidden text and links - PSA-2013-001

Date:

2013-September-04

Advisory ID: PSA-2013-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2013-September-04
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2013-073 - Make Meeting Scheduler - Access Bypass

By Drupal Security Team on 4 Sep 2013 at 14:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-073
Project: Make Meeting Scheduler (third-party module)
Version: 6.x
Date: 2013-September-04
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-072 - Node View Permissions - Access Bypass

By Drupal Security Team on 28 Aug 2013 at 18:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-072
Project: Node View Permissions (third-party module)
Version: 7.x
Date: 2013-August-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-071 - Flag - Cross Site Scripting

By Drupal Security Team on 28 Aug 2013 at 17:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-071
Project: Flag (third-party module)
Version: 7.x
Date: 2013-August-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-070 - Zen - Cross Site Scripting

By Drupal Security Team on 21 Aug 2013 at 19:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-070
Project: Zen (third-party module)
Version: 7.x
Date: 2013-August-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-069 - Password Policy - XSS

By Drupal Security Team on 14 Aug 2013 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-069
Project: Password policy (third-party module)
Version: 6.x, 7.x
Date: 2013-August-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-068 - Entity API - Access Bypass

By Drupal Security Team on 14 Aug 2013 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-068
Project: Entity API (third-party module)
Version: 7.x
Date: 2013-August-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-067 - BOTCHA - Information Disclosure (potential Privilege Escalation)

By Drupal Security Team on 14 Aug 2013 at 13:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-067
Project: BOTCHA Spam Prevention (third-party module)
Version: 7.x
Date: 2013-August-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2013-066 - Monster Menus - Multiple Vulnerabilities

By Drupal Security Team on 7 Aug 2013 at 19:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-066
Project: Monster Menus (third-party module)
Version: 6.x, 7.x
Date: 2013-August-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-065 - Organic Groups - Access Bypass

By Drupal Security Team on 7 Aug 2013 at 18:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-065
Project: Organic groups (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass, Multiple vulnerabilities

SA-CONTRIB-2013-064 - Persona - Cross site request forgery (CSRF)

By Drupal Security Team on 7 Aug 2013 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-064
Project: Mozilla Persona (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-063 - Authenticated User Page Caching (Authcache) - Information Disclosure

By Drupal Security Team on 7 Aug 2013 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-063
Project: Authenticated User Page Caching (Authcache) (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2013-062 - RESTful Web Services (RESTWS) - Access Bypass

By Drupal Security Team on 7 Aug 2013 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-062
Project: RESTful Web Services (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-061 - Flippy - Access Bypass

By Drupal Security Team on 31 Jul 2013 at 15:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-061
Project: Flippy (third-party module)
Version: 7.x
Date: 2013-July-31
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-060 - Scald - Cross Site Scripting (XSS)

By Drupal Security Team on 24 Jul 2013 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-060
Project: Scald (third-party module)
Version: 6.x, 7.x
Date: 2013-July-24
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-059 - Hostmaster (Aegir) - Access Bypass

By Drupal Security Team on 17 Jul 2013 at 18:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-059
Project: Hostmaster (Aegir) (third-party module)
Version: 6.x
Date: 2013-July-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-058 - MRBS - Abandoned - Mutliple vulnerabilities

By Drupal Security Team on 17 Jul 2013 at 15:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-058
Project: MRBS (third-party module)
Version: 6.x, 7.x
Date: 2013-July-17
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery, SQL Injection

SA-CONTRIB-2013-057 - TinyBox - Cross Site Scripting (XSS)

By Drupal Security Team on 10 Jul 2013 at 14:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-057
Project: TinyBox (Simple Splash) (third-party module)
Version: 7.x
Date: 2013-July-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-056 - Stage File Proxy - Denial of Service

By Drupal Security Team on 10 Jul 2013 at 14:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-056
Project: Stage File Proxy (third-party module)
Version: 7.x
Date: 2013-July-10th
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2013-055 - Hatch - Cross Site Scripting

By Drupal Security Team on 9 Jul 2013 at 21:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-055
Project: Hatch (third-party theme)
Version: 7.x
Date: 2013-July-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-054 - Fast Permissions Administration - Access Bypass

By Drupal Security Team on 26 Jun 2013 at 15:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-054
Project: Fast Permissions Administration (third-party module)
Version: 6.x, 7.x
Date: 2013-June-26
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-053 - Login Security - Multiple Vulnerabilities

By Drupal Security Team on 19 Jun 2013 at 17:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-053
Project: Login Security (third-party module)
Version: 6.x, 7.x
Date: 2013-June-19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2013-052 - Display Suite - Cross Site Scripting (XSS)

By Drupal Security Team on 12 Jun 2013 at 15:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-052
Project: Display Suite (third-party module)
Version: 7.x
Date: 2013-June-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-051 - Services - Cross site request forgery (CSRF)

By Drupal Security Team on 5 Jun 2013 at 18:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-051
Project: Services (third-party module)
Version: 6.x, 7.x
Date: 2013-June-05
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-050 - Webform - Cross Site Scripting (XSS)

By Drupal Security Team on 29 May 2013 at 22:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-050
Project: Webform (third-party module)
Version: 6.x
Date: 2013-May-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-049 - Node access user reference - Access Bypass

By Drupal Security Team on 29 May 2013 at 15:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-049
Project: Node access user reference (third-party module)
Version: 6.x, 7.x
Date: 2013-May-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-048 - Edit Limit - Access Bypass

By Drupal Security Team on 29 May 2013 at 14:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-048
Project: Edit Limit (third-party module)
Version: 7.x
Date: 2013-May-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-047 - Google Authenticator login - Access Bypass

By Drupal Security Team on 15 May 2013 at 18:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-047
Project: Google Authenticator login (third-party module)
Version: 6.x, 7.x
Date: 2013-May-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-046 - Filebrowser - Reflected Cross Site Scripting (XSS)

By Drupal Security Team on 1 May 2013 at 15:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-046
Project: Filebrowser (third-party module)
Version: 6.x
Date: 2013-May-1
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-045 - Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) - Access bypass

By Drupal Security Team on 17 Apr 2013 at 16:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-045
Project: Autocomplete Widgets for Text and Number Fields (third-party module)
Version: 6.x, 7.x
Date: 2013-April-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-044 - elFinder file manager - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 17 Apr 2013 at 16:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-044
Project: elFinder file manager (third-party module)
Version: 6.x, 7.x
Date: 2013-April-17
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-043 - MP3 Player - Cross Site Scripting (XSS)

By Drupal Security Team on 17 Apr 2013 at 14:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-043
Project: MP3 Player (third-party module)
Version: 6.x
Date: 2013-April-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-042 - RESTful Web Services (RESTWS) - Denial of Service

By Drupal Security Team on 10 Apr 2013 at 15:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-042
Project: RESTful Web Services (third-party module)
Version: 7.x
Date: 2013-April-10
Security risk: Critical
Exploitable from: Remote
Vulnerability: Denial of Service

SA-CONTRIB-2013-041 - Chaos tool suite (ctools) - Access bypass

By Drupal Security Team on 3 Apr 2013 at 18:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-041
Project: Chaos tool suite (ctools) (third-party module)
Version: 7.x
Date: 2013-April-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-040 - Commerce Skrill (Formerly Moneybookers) - Access bypass

By Drupal Security Team on 3 Apr 2013 at 17:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-040
Project: Commerce Skrill (Formerly Moneybookers) (third-party module)
Version: 7.x
Date: 2013-April-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation

By Drupal Security Team on 27 Mar 2013 at 20:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-039
Project: Commons Wikis (third-party module)
Version: 7.x
Date: 2013-March-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Multiple vulnerabilities

SA-CONTRIB-2013-038 - Commons Groups - Access bypass & Privilege escalation

By Drupal Security Team on 27 Mar 2013 at 20:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-038
Project: Commons Groups (third-party module)
Version: 7.x
Date: 2013-March-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Multiple vulnerabilities

Pages

Subscribe with RSS