Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2012-068 - Node Gallery - Cross Site Request Forgery (CSRF) - Unsupported

By Drupal Security Team on 2 May 2012 at 14:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-068
Project: Node Gallery (third-party module)
Version: 6.x
Date: 2012-May-02
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-067 - Linkit - Access bypass

By Drupal Security Team on 25 Apr 2012 at 19:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-067
Project: Linkit (third-party module)
Version: 7.x
Date: 2012-April-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-066 - Spaces and Spaces OG - Access Bypass

By Drupal Security Team on 25 Apr 2012 at 19:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-066
Project: Spaces (third-party module)
Version: 6.x
Date: 2012-April-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-065 - Sitedoc - Information disclosure

By Drupal Security Team on 25 Apr 2012 at 19:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-065
Project: Site Documentation (third-party module)
Version: 6.x
Date: 2012-April-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-064 - Ubercart - Multiple vulnerabilities

By Drupal Security Team on 25 Apr 2012 at 19:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-064
Project: Ubercart (third-party module)
Version: 6.x, 7.x
Date: 2012-April-25
Security risk: Moderately critical
Exploitable from: Varies (Local & Remote)
Vulnerability: Cross Site Scripting, Arbitrary PHP code execution, Multiple vulnerabilities

SA-CONTRIB-2012-063 - RealName - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Apr 2012 at 18:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-063
Project: RealName (third-party module)
Version: 6.x
Date: 2012-April-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-062 - Creative Commons - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Apr 2012 at 17:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-062
Project: Creative Commons (third-party module)
Version: 6.x
Date: 2012-April-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-061 - Gigya - Social optimization - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Apr 2012 at 21:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-061
Project: Gigya - Social optimization (third-party module)
Version: 6.x
Date: 2012-April-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-060 - Commerce Reorder - Cross Site Request Forgery

By Drupal Security Team on 18 Apr 2012 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-060
Project: Commerce Reorder (third-party module)
Version: 7.x
Date: 2012-April-18
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-059 - Autosave - Cross Site Request Forgery

By Drupal Security Team on 11 Apr 2012 at 19:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-059
Project: Autosave (third-party module)
Version: 6.x, 7.x
Date: 2012-April-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-058 - Fivestar - Input Validation

By Drupal Security Team on 11 Apr 2012 at 15:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-058
Project: Fivestar (third-party module)
Version: 6.x
Date: 2012-April-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Input Validation

SA-CONTRIB-2012-057 - Printer, email and PDF versions - Cross Site Scripting (XSS)

By Drupal Security Team on 4 Apr 2012 at 22:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-057
Project: Printer, email and PDF versions (third-party module)
Version: 6.x, 7.x
Date: 2012-April-04
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability

By Drupal Security Team on 4 Apr 2012 at 17:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-056
Project: Janrain Engage (formerly RPX) (third-party module)
Version: 6.x, 7.x
Date: 2012-April-04
Security risk: Less critical
Exploitable from: Not exploitable
Vulnerability: Sensitive Data Protection Vulnerability

SA-CONTRIB-2012-055 - Fusion theme - Cross Site Scripting (XSS)

By Drupal Security Team on 28 Mar 2012 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-055
Project: Fusion (third-party theme)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-054 - Chaos tool suite - Cross Site Scripting (XSS)

By Drupal Security Team on 28 Mar 2012 at 20:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-054
Project: Chaos tool suite (ctools) (third-party module)
Version: 7.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-053 - Organic Groups - Access Bypass

By Drupal Security Team on 28 Mar 2012 at 19:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-053
Project: Organic groups (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-052 - Node Limit Number - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 28 Mar 2012 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-052
Project: Node Limit Number (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-051 - Activity - Multiple Vulnerablities

By Drupal Security Team on 28 Mar 2012 at 15:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-051
Project: Activity (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-050 - CDN2 Video - Unsupported

By Drupal Security Team on 28 Mar 2012 at 14:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-050
Project: CDN2 Video (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2012-049 - ShareThis - Multiple Vulnerablies

By Drupal Security Team on 28 Mar 2012 at 13:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-049
Project: ShareThis (third-party module)
Version: 7.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting

By Drupal Security Team on 28 Mar 2012 at 13:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-048
Project: Contact Save (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-047 - Ubercart Views - Information disclosure

By Drupal Security Team on 28 Mar 2012 at 13:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-047
Project: Ubercart Views (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-046 - Bundle Copy - Arbitrary Code execution

By Drupal Security Team on 28 Mar 2012 at 13:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-046
Project: Bundle copy (third-party module)
Version: 7.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Arbitrary PHP code execution

SA-CONTRIB-2012-045 - AddToAny - Cross Site Scripting

By Drupal Security Team on 28 Mar 2012 at 13:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-045
Project: Share Buttons (AddToAny) by Lockerz (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-044 - Contact Forms - Cross Site Scripting

By Drupal Security Team on 28 Mar 2012 at 13:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-044
Project: Contact Forms (third-party module)
Version: 6.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-043 - MultiBlock - Cross Site Scripting

By Drupal Security Team on 28 Mar 2012 at 13:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-043
Project: MultiBlock (third-party module)
Version: 6.x, 7.x
Date: 2012-March-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-042 - Wishlist Cross Site Scripting (XSS)

By Drupal Security Team on 21 Mar 2012 at 15:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-042
Project: Wishlist Module (third-party module)
Version: 6.x, 7.x
Date: 2012-March-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-041 - Fancy Slide - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Mar 2012 at 21:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-041
Project: Fancy Slide (third-party module)
Version: 6.x
Date: 2012-March-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution

By Drupal Security Team on 14 Mar 2012 at 18:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-040
Project: CKEditor, FCKeditor - WYSIWYG HTML editor (third-party module)
Version: 6.x, 7.x
Date: 2012-March-14
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Arbitrary PHP code execution

SA-CONTRIB-2012-039 - Language Icons - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Mar 2012 at 17:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-039
Project: Language icons (third-party module)
Version: 6.x, 7.x
Date: 2012-March-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-038 - Views Language Switcher Cross Site Scripting (XSS)

By Drupal Security Team on 14 Mar 2012 at 17:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-038
Project: Views Language Switcher (third-party module)
Version: 7.x
Date: 2012-March-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-037 - Slidebox - access bypass

By Drupal Security Team on 14 Mar 2012 at 16:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-037
Project: Slidebox (third-party module)
Version: 7.x
Date: 2012-March-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-036 - Multiple Modules Unsupported

By Drupal Security Team on 14 Mar 2012 at 13:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-036
Projects: Content Lock, Ubercart Bulk Stock Updater, Ubercart Payflow Link, ticketyboo News Ticker, Admin tools, Redirecting click bouncer (third-party modules)
Version: 6.x
Version: 7.x
Date: 2012-March-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-035 - Webform Cross Site Scripting (XSS)

By Drupal Security Team on 7 Mar 2012 at 20:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-035
Project: Webform (third-party module)
Version: 6.x, 7.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-034 - Node Recommendation Cross Site Scripting (XSS)

By Drupal Security Team on 7 Mar 2012 at 16:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-034
Project: Node Recommendation (third-party module)
Version: 6.x
Date: 2012-March-7
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

localizations - Cross Site Scripting - PSA-2012-001

Date:

2012-March-07

Advisory ID: DRUPAL-PSA-2012-001
Version: 6.x, 7.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-033 - Read More Link - Cross Site Scripting

By Drupal Security Team on 7 Mar 2012 at 15:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-033
Project: Read More Link (third-party module)
Version: 6.x
Date: 2012-March-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-032 - Block Class - Cross Site scripting

By Drupal Security Team on 7 Mar 2012 at 15:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-032
Project: Block Class (third-party module)
Version: 7.x
Date: 2012-March-07
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-031 - Multiple Modules Unsupported - UC PayDutchGroup - Information leakage and Multisite Search sql injection

By Drupal Security Team on 7 Mar 2012 at 15:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-031
Projects: UC PayDutchGroup / WeDeal payment, Multisite Search (third-party modules)
Version: 6.x
Date: 2012-March-7
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure