Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2010-002 - Currency Exchange - Cross site scripting

By Drupal Security Team on 6 Jan 2010 at 19:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-002
Project: Currency Exchange (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-001 - Wunderbar - Cross Site Scripting

By Drupal Security Team on 6 Jan 2010 at 19:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-001
Project: Wunderbar! (third-party module)
Version: 6.x
Date: 2010-January-6
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-115 - Autocomplete Widgets for CCK Text and Number - Information Disclosure

By Drupal Security Team on 30 Dec 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-115
Project: Autocomplete Widgets for CCK Text and Number (third-party module)
Version: 6.x
Date: 2009-December-30
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2009-114 - Automated Logout - Cross Site Scripting

By Drupal Security Team on 24 Dec 2009 at 03:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-114
Project: Automated Logout (third-party module)
Version: 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-113 - FAQ - Cross Site Scripting

By Drupal Security Team on 23 Dec 2009 at 18:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-113
Project: FAQ (third-party module)
Version: 5.x, 6.x
Date: 2009-December-23
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2009-009 - Drupal Core - Cross site scripting

By Drupal Security Team on 16 Dec 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CORE-2009-009
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-112 - Sections - Cross Site Scripting

By Drupal Security Team on 16 Dec 2009 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-112
Project: Sections (third-party module)
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-111 - Randomizer - Cross Site Scripting

By Drupal Security Team on 9 Dec 2009 at 21:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-111
Project: Randomizer (third-party module)
Version: 5.x, 6.x
Date: 2009-December-09
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-110 - Taxonomy Timer - SQL Injection

By Drupal Security Team on 2 Dec 2009 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-110
Project: Taxonomy Timer (third-party module)
Version: 5.x, 6.x
Date: 2009-November-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2009-109 - Printfriendly - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 22:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-109
Project: Printfriendly (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-108 - Gallery Assist - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 22:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-108
Project: Gallery Assist (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-107 - Ubercart - Access bypass, Cross site request forgery

By Drupal Security Team on 18 Nov 2009 at 20:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-107
Project: Ubercart (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross-site request forgery

Description

Ubercart's PayPal Website Payments Standard integration exposes a path for completed orders without properly checking that the order is valid for the current user. In the event that the order has already been processed for checkout, this can result in duplicate actions taking place inadvertently. Furthermore, if the checkout completion message has been modified to include order details, information disclosure can happen.

The Ubercart order management was also affected by a minor cross-site request forgery vulnerability.

Versions affected

Ubercart module for Drupal 6.x prior to Ubercart 6.x-2.1
Ubercart module for Drupal 5.x prior to Ubercart 5.x-1.9

Drupal core is not affected. If you do not use the contributed Ubercart module, there is nothing you need to do.

Solution

Upgrade to the latest version:

SA-CONTRIB-2009-106 - Agreement - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-106
Project: Agreement (third-party module)
Version: 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-105 - Subgroups for Organic Groups - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 20:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-105
Project: Subgroups for Organic Groups (third-party module)
Version: 5.x
Date: 2009-November-18
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-104 - Feed Element Mapper - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 19:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-104
Project: Feed Element Mapper (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-103 - Strongarm - Cross Site Scripting

By Drupal Security Team on 18 Nov 2009 at 18:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-103
Project: Strongarm (third-party module)
Version: 6.x
Date: 2009 November 18
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-102 - PHPList Integration Module - Cross Site Request Forgery

By pwolanin on 18 Nov 2009 at 17:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-102
Project: PHPList Inegration Module (third-party module)
Version: 5.x, 6.x
Date: 2009-November-18
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-CONTRIB-2009-101 - Web Services - Access Bypass

By Drupal Security Team on 11 Nov 2009 at 22:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-101
Project: Web Services (third-party theme)
Version: 6.x
Date: 2009-November-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-100 - AddToAny - Cross Site Scripting

By undefined on 11 Nov 2009 at 22:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-100
Project: AddToAny (third-party module)
Version: 5.x, 6.x
Date: 2009 November 11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-099 - RootCandy Theme - Cross Site Scripting

By meba on 11 Nov 2009 at 21:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-099
Project: RootCandy (third-party theme)
Version: 6.x
Date: 2009-November-11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-098 - Zoomify - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 22:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-098
Project: Zoomify (third-party module)
Version: 5.x, 6.x
Date: 2009-November-4
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-097 - Organic Groups Vocabulary - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 22:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-097
Project: Organic Groups Vocabulary (third-party module)
Version: 6.x
Date: 2009-November-4
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-096 - Link - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 20:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-096
Project: Link (third-party module)
Version: 5.x, 6.x
Date: 2009-November-4
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass

By Drupal Security Team on 4 Nov 2009 at 20:02 UTC

Advisory ID: SA-CONTRIB-2009-095
Project: Smartqueues for Organic Groups (smartqueue_og) (third-party module)
Version: 6.x
Date: 2009 November 4
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-094 - NGP COO/CWP Integration (crmngp) - Multiple Vulnerabilities

By coltrane on 4 Nov 2009 at 19:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-094
Project: NGP COO/CWP Integration (crmngp) (third-party module)
Version: 6.x
Date: 2009-November-4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-site scripting and Access bypass

SA-CONTRIB-2009-093 - Temporary Invitation - Cross Site Scripting

By meba on 4 Nov 2009 at 19:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-093
Project: Temporary Invitation (third-party module)
Version: 5.x
Date: 2009 November 4
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-092 - S5 Presentation Player Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 19:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-092
Project: S5 Presentation Player (third-party module)
Version: 6.x
Date: 2009 November 4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-091 - Node Hierarchy - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 19:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-091
Project: Node Hierarchy (third-party module)
Version: 6.x, 5.x
Date: 2009 November 4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-090 - User Protect - Cross Site Request Forgery

By hunmonk on 4 Nov 2009 at 13:20 UTC

Advisory ID: SA-CONTRIB-2009-090
Project: User Protect (third-party module)
Version: 5.x, 6.x
Date: 2009-November-04
Security risk: Moderate
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-CONTRIB-2009-089 - Storm - Access Bypass

By greggles on 28 Oct 2009 at 22:43 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-089
Project: Storm (third-party module)
Version: 6.x
Date: 2009-October-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-088 - Workflow Multiple Cross Site Scripting Vulnerabilities

By greggles on 28 Oct 2009 at 22:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-088
Project: Workflow (third-party module)
Version: 6.x, 5.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-087 - FAQ Ask - Multiple Vulnerabilities

By greggles on 28 Oct 2009 at 21:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-087
Project: FAQ Ask (third-party module)
Version: 6.x
Date: 2009 October 28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple Vulnerabilities (XSS, CSRF, Open Redirect)

SA-CONTRIB-2009-086 - OpenSocial Shindig-Integrator - Cross Site Scripting

By Drupal Security Team on 28 Oct 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-086
Project: OpenSocial Shindig-Integrator (third-party module)
Version: 6.x, 5.x
Date: 2009-October-86
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-085 - Insert Node - Cross Site Scripting

By Drupal Security Team on 28 Oct 2009 at 21:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-085
Project: Insert Node (third-party module)
Version: 5.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-084 - LDAP Integration - Multiple Vulnerabilities

By Drupal Security Team on 28 Oct 2009 at 20:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-084
Project: LDAP Integration (third-party module)
Version: 6.x, 5.x
Date: 2009-October-28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-083 - CCK Comment Reference - Access Bypass

By Drupal Security Team on 28 Oct 2009 at 20:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-083
Project: CCK Comment Reference (third-party module)
Version: 6.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-082 - Filefield module access bypass

By greggles on 21 Oct 2009 at 22:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-082
Project: FileField (third-party module)
Version: 6.x
Date: 2009-October-20
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-081 - Abuse - Cross Site Scripting

By meba on 21 Oct 2009 at 21:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-081
Project: Abuse (third-party module)
Version: 5.x, 6.x
Date: 2009 October 21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-080 - Simplenews Statistics - Multiple vulnerabilities

By Drupal Security Team on 21 Oct 2009 at 20:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-080
Project: Simplenews Statistics (third-party module)
Version: 6.x
Date: 2009 October 21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities (XSS, CSRF, Open Redirect)

SA-CONTRIB-2009-079 - vCard - Cross Site Scripting

By Drupal Security Team on 21 Oct 2009 at 20:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-079
Project: vCard module (third-party module)
Version: 6.x, 5.x
Date: 2009-October-21
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-078 - Moodle Course List - SQL Injection

By Drupal Security Team on 21 Oct 2009 at 20:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-078
Project: Moodle Course List module (third-party module)
Version: 6.x
Date: 2009-October-21
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2009-075 - OG Vocabulary 5.x

By greggles on 21 Oct 2009 at 19:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-075
Project: Organic Groups Vocabulary (third-party module)
Version: 5.x
Date: 2009-October-21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-076 - Flag Content Cross Site Scripting

By kbahey on 21 Oct 2009 at 18:28 UTC

Advisory ID: SA-CONTRIB-2009-076
Project: Flag Content (third-party module)
Version: 5.x
Date: 2009-October-21
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

DRUPAL-SA-CONTRIB-2009-077 - Userpoints - Information disclosure

By Drupal Security Team on 21 Oct 2009 at 17:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-077
Project: Userpoints (third party module)
Version: 6.x
Date: 2009-October-21
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information disclosure

SA-CONTRIB-2009-074- Webform - Multiple vulnerabilities

By cwgordon7 on 15 Oct 2009 at 02:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-074
Project: Webform (third-party module)
Version: 5.x, 6.x
Date: 2009-October-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

DRUPAL-SA-CONTRIB-2009-073 - Printer, e-mail and PDF versions multiple vulnerabilities

By Drupal Security Team on 14 Oct 2009 at 23:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-073
Project: Printer, e-mail and PDF versions (third-party module)
Version: 5.x, 6.x
Date: 2009-October-14
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-072 - RealName - Cross Site Scripting

By drumm on 14 Oct 2009 at 22:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-072
Project: RealName (third-party module)
Version: 6.x
Date: 2009-October-14
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-071 - Organic Groups Vocabulary Access Bypass

By greggles on 14 Oct 2009 at 17:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-071
Project: OG Vocabulary (third party module)
Version: 6.x
Date: 2009-October-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-070 - Shibboleth authentication - Impersonation, privilege escalation

By coltrane on 14 Oct 2009 at 17:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-070
Project: Shibboleth authentication (third-party module)
Version: 6.x, 5.x
Date: 2009-October-14
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Impersonation, privilege escalation

SA-CONTRIB-2009-068 - Boost - Filesystem Directory Creation

By Drupal Security Team on 30 Sep 2009 at 20:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-068
Project: Boost (third-party module)
Version: 6.x-1.*
Date: 2009-09-30
Security risk: Low
Exploitable from: Remote
Vulnerability: Filesystem Directory Creation

Pages

Subscribe with RSS