Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2012-038 - Views Language Switcher Cross Site Scripting (XSS)

By Drupal Security Team on 14 Mar 2012 at 17:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-038
Project: Views Language Switcher (third-party module)
Version: 7.x
Date: 2012-March-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-037 - Slidebox - access bypass

By Drupal Security Team on 14 Mar 2012 at 16:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-037
Project: Slidebox (third-party module)
Version: 7.x
Date: 2012-March-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-036 - Multiple Modules Unsupported

By Drupal Security Team on 14 Mar 2012 at 13:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-036
Projects: Content Lock, Ubercart Bulk Stock Updater, Ubercart Payflow Link, ticketyboo News Ticker, Admin tools, Redirecting click bouncer (third-party modules)
Version: 6.x
Version: 7.x
Date: 2012-March-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-035 - Webform Cross Site Scripting (XSS)

By Drupal Security Team on 7 Mar 2012 at 20:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-035
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-034 - Node Recommendation Cross Site Scripting (XSS)

By Drupal Security Team on 7 Mar 2012 at 16:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-034
Project: Node Recommendation (third-party module)
Version: 6.x
Date: 2012-March-7
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

localizations - Cross Site Scripting - PSA-2012-001

Date:

2012-March-07

Advisory ID: DRUPAL-PSA-2012-001
Version: 6.x, 7.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-033 - Read More Link - Cross Site Scripting

By Drupal Security Team on 7 Mar 2012 at 15:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-033
Project: Read More Link (third-party module)
Version: 6.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-032 - Block Class - Cross Site scripting

By Drupal Security Team on 7 Mar 2012 at 15:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-032
Project: Block Class (third-party module)
Version: 7.x
Date: 2012-March-07
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-031 - Multiple Modules Unsupported - UC PayDutchGroup - Information leakage and Multisite Search sql injection

By Drupal Security Team on 7 Mar 2012 at 15:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-031
Projects: UC PayDutchGroup / WeDeal payment, Multisite Search (third-party modules)
Version: 6.x
Date: 2012-March-7
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-030 - Data - Cross Site Scripting (XSS)

By Drupal Security Team on 7 Mar 2012 at 15:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-030
Project: Data (third-party module)
Version: 6.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-029 - Taxonomy Views Integrator - Cross Site Scripting (XSS)

By Drupal Security Team on 29 Feb 2012 at 20:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-029
Project: Taxonomy Views Integrator (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-028 - Hierarchical Select - Cross Site Scripting (XSS)

By Drupal Security Team on 29 Feb 2012 at 17:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-028
Project: Hierarchical Select (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-027 - Submenu Tree -Cross Site Scripting

By Drupal Security Team on 29 Feb 2012 at 14:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-027
Project: Submenu Tree (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-026 - ZipCart - Access bypass

By Drupal Security Team on 29 Feb 2012 at 14:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-026
Project: ZipCart (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-025 - Cool aid; Editable help messages - Multiple vulnerabilities

By Drupal Security Team on 29 Feb 2012 at 14:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-025
Project: Cool aid; Editable help messages (third-party module)
Version: 6.x
Date: 2012-February-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting

SA-CONTRIB-2012-024 - MediaFront - Cross Site Scripting

By Drupal Security Team on 29 Feb 2012 at 13:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-024
Project: MediaFront (third-party module)
Version: 6.x, 7.x
Date: 2012-February-29
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-023 - FAQ - Cross Site Scripting

By Drupal Security Team on 22 Feb 2012 at 22:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-023
Project: Frequently Asked Questions (third-party module)
Version: 6.x
Date: 2012-February-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-022 - CDN - Information disclosure

By Drupal Security Team on 15 Feb 2012 at 20:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-022
Project: CDN (third-party module)
Version: 6.x, 7.x
Date: 2012-February-15
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-021 - Organic Groups Vocab Access Bypass

By Drupal Security Team on 15 Feb 2012 at 20:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-021
Project: Organic Groups Vocabulary (third-party module)
Version: 6.x
Date: 2012-February-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-020 - Faster Permissions - Access bypass

By Drupal Security Team on 15 Feb 2012 at 20:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-020
Project: Faster Permissions (third-party module)
Version: 7.x
Date: 2012-February-15
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-019 - Link checker - Access bypass

By Drupal Security Team on 15 Feb 2012 at 17:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-019
Project: Link checker (third-party module)
Version: 6.x
Date: 2012-February-15
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-018 - Revisioning - Cross Site Scripting

By Drupal Security Team on 9 Feb 2012 at 00:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-018
Project: Revisioning (third-party module)
Version: 6.x
Date: 2012-FEB-08
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-017 - Finder - Multiple vulnerabilities

By Drupal Security Team on 8 Feb 2012 at 16:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-017
Project: Finder (third-party module)
Version: 6.x, 7.x
Date: 2012-February-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Arbitrary PHP code execution, Multiple vulnerabilities

SA-CONTRIB-2012-016 - Forward module CSRF and Access bypass

By Drupal Security Team on 1 Feb 2012 at 22:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-016
Project: Forward (third-party module)
Version: 6.x, 7.x
Date: 2012-February-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Request Forgery

SA-CORE-2012-001 - Drupal core multiple vulnerabilities

By Drupal Security Team on 1 Feb 2012 at 22:06 UTC

Advisory ID: DRUPAL-SA-CORE-2012-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2012-February-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Request Forgery, Multiple vulnerabilities

SA-CONTRIB-2012-015 - Managesite - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Jan 2012 at 21:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-015
Project: Managesite (third-party module)
Version: 6.x
Date: 2012-January-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-014 - Drupal Commerce - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Jan 2012 at 19:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-014
Project: Drupal Commerce (third-party module)
Version: 7.x
Date: 2012-January-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-013 - Search Autocomplete - SQL Injection

By Drupal Security Team on 25 Jan 2012 at 16:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-013
Project: Search Autocomplete (third-party module)
Version: 7.x
Date: 2012-January-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2012-012 - Quicktabs - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jan 2012 at 20:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-012
Project: Quick Tabs (third-party module)
Version: 6.x, 7.x
Date: 2012-January-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-011 - Panels - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jan 2012 at 19:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-011
Project: Panels (third-party module)
Version: 6.x
Date: 2012-January-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-010 - stickynote - Multiple vulnerabilities

By Drupal Security Team on 18 Jan 2012 at 19:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-010
Project: stickynote (third-party module)
Version: 7.x
Date: 2012-January-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-009 - Revisioning - Access bypass

By Drupal Security Team on 18 Jan 2012 at 17:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-009
Project: Revisioning (third-party module)
Version: 7.x
Date: 2012-January-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Hash DOS attack prevention with Suhosin needs a .htaccess edit - PSA-2012-001

Date:

2012-January-11

Advisory ID: DRUPAL-PSA-2012-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2012-01-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Denial of Service

SA-CONTRIB-2012-008 - Video Filter - Cross Site Scripting

By Drupal Security Team on 11 Jan 2012 at 20:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-008
Project: Video Filter (third-party module)
Version: 6.x, 7.x
Date: 2012-JANUARY-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-007 - Password Policy - Multiple vulnerabilities

By Drupal Security Team on 11 Jan 2012 at 17:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-007
Project: Password policy (third-party module)
Version: 6.x
Date: 2012-January-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-006 XSS and CSRF in Multiple Modules - Supercron, Taxotouch, Admin:hover, Taxonomy Navigator no longer supported

By Drupal Security Team on 11 Jan 2012 at 17:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-006
Projects: SuperCron, Taxotouch, Taxonomy Navigator, Admin:hover (third-party modules)
Version: 6.x, 7.x
Date: 2012-January-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery