Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2014-082 - Marketo MA - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Aug 2014 at 16:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-082
Project: Marketo MA (third-party module)
Version: 7.x
Date: 2014-08-20
Security risk: 8/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Proof/TD:100
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-081 - Site Banner - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Aug 2014 at 14:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-081
Project: Site Banner (third-party module)
Version: 7.x
Date: 2014-Aug-20
Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Proof/TD:75
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-080 - Social Stats - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Aug 2014 at 14:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-080
Project: Social Stats (third-party module)
Version: 7.x
Date: 2014-August-20
Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:100
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-079 - RedHen CRM - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Aug 2014 at 13:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-079
Project: RedHen CRM (third-party module)
Version: 7.x
Date: 2014-August-20
Security risk: 7/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Theoretical/TD:100
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-078 - Notify - Access bypass

By Drupal Security Team on 13 Aug 2014 at 16:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-078
Project: Notify (third-party module)
Version: 7.x
Date: 2014-August-13
Security risk: 10/25 ( Moderately Critical) AC:Complex/A:User/CI:Some/II:None/E:Proof/TD:75
Vulnerability: Access bypass

SA-CONTRIB-2014-077 - TableField - Cross Site Scripting (XSS)

By Drupal Security Team on 13 Aug 2014 at 13:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-077
Project: TableField (third-party module)
Version: 7.x
Date: 2014-August-13
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:25
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-076 - Fasttoggle - Access bypass

By Drupal Security Team on 6 Aug 2014 at 20:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-076
Project: Fasttoggle (third-party module)
Version: 7.x
Date: 2014-August-06
Security risk: 11/25 (

Moderately Critical

) AC:Basic/A:None/CI:None/II:None/E:Exploit/TD:25
Vulnerability: Access bypass

SA-CONTRIB-2014-075 - Biblio Autocomplete - SQL injection and Access Bypass

By Drupal Security Team on 6 Aug 2014 at 19:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-075
Project: Biblio Autocomplete (third-party module)
Version: 6.x, 7.x
Date: 2014-August-06
Security risk: 23/25 (

Highly Critical

) AC:Basic/A:None/CI:All/II:All/E:Exploit/TD:100
Vulnerability: Access bypass, SQL Injection

SA-CORE-2014-004 - Drupal core - Denial of service

By Drupal Security Team on 6 Aug 2014 at 17:41 UTC

Advisory ID: DRUPAL-SA-CORE-2014-004
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-August-06
Security risk: 13/25 (

Moderately Critical

) AC:None/A:None/CI:None/II:None/E:Proof/TD:100
Exploitable from: Remote
Vulnerability: Denial of service

SA-CONTRIB-2014-074 - Storage API - Code execution prevention

By Drupal Security Team on 30 Jul 2014 at 19:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-074
Project: Storage API (third-party module)
Version: 7.x
Date: 2014-July-30
Security risk: (Less Critical)
Vulnerability: Arbitrary PHP code execution

SA-CONTRIB-2014-073- Date - Cross Site Scripting (XSS)

By Drupal Security Team on 30 Jul 2014 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-073
Project: Date (third-party module)
Version: 7.x
Date: 2014-July-30
Security risk: Moderately Critical
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-072 - Freelinking, Freelinking Case Tracker - Access bypass

By Drupal Security Team on 23 Jul 2014 at 17:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-072
Project: freelinking (third-party module)
Project: freelinking case tracker (third-party module)
Version: 6.x, 7.x
Date: 2014-July-23
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-071 - FileField - Access bypass

By Drupal Security Team on 16 Jul 2014 at 20:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-071
Project: FileField (third-party module)
Version: 6.x
Date: 2014-July-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2014-003 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 16 Jul 2014 at 14:48 UTC

Advisory ID: DRUPAL-SA-CORE-2014-003
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-July-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2014-070 - Password Policy - Access Bypass

By Drupal Security Team on 16 Jul 2014 at 13:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-070
Project: Password Policy (third-party module)
Version: 6.x, 7.x
Date: 2014-July-16
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-069 - Logintoboggan - Access Bypass and Cross Site Scripting (XSS)

By Drupal Security Team on 9 Jul 2014 at 17:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-069
Project: LoginToboggan (third-party module)
Version: 7.x
Date: 2014-July-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Access bypass

SA-CONTRIB-2014-068 - Pane - XSS

By Drupal Security Team on 2 Jul 2014 at 20:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-068
Project: Pane (third-party module)
Version: 7.x
Date: 2014-July-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-067 - Meta Tags Quick - Multiple vulnerabilities

By Drupal Security Team on 2 Jul 2014 at 13:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-067
Project: Meta tags quick (third-party module)
Version: 7.x
Date: 2014-July-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Open Redirect

SA-CONTRIB-2014-066 - Node Access Keys - Access Bypass

By Drupal Security Team on 2 Jul 2014 at 13:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-066
Project: Node Access Keys (third-party module)
Version: 7.x
Date: 2014-July-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-065 - Custom Meta - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jun 2014 at 14:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-065
Project: Custom Meta (third-party module)
Version: 6.x, 7.x
Date: 2014-June-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-064 -Course - Access bypass

By Drupal Security Team on 18 Jun 2014 at 14:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-064
Project: Course (third-party module)
Version: 6.x, 7.x
Date: 2014-June-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-063 - Easy Breadcrumb - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jun 2014 at 13:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-063
Project: Easy Breadcrumb (third-party module)
Version: 7.x
Date: 2014-June-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-062 -Passsword Policy - Multiple vulnerabilities

By Drupal Security Team on 18 Jun 2014 at 12:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-062
Project: Password policy (third-party module)
Version: 6.x, 7.x
Date: 2014-June-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2014-061 - VideoWhisper Webcam Plugins - Cross Site Scripting (XSS) - Unsupported

By Drupal Security Team on 18 Jun 2014 at 12:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-061
Project: VideoWhisper Webcam Plugins (third-party module)
Version: 7.x
Date: 2014-June-18
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-060- Petitions - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 11 Jun 2014 at 18:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-060
Project: - Petitions - (third-party distribution)
Version: 7.x
Date: 2014-June-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2014-059 - Touch Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Jun 2014 at 15:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-059
Project: Touch (third-party module)
Version: 7.x
Date: 2014-June-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-058 - Webserver Auth - Access Bypass

By Drupal Security Team on 28 May 2014 at 14:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-058
Project: Webserver authentication (third-party module)
Version: 7.x
Date: 2014-May-28
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Drupal core - Information disclosure - PSA-2014-002

Date:

2014-May-21

Advisory ID: DRUPAL-PSA-2014-002
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-May-21
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-057 - Password policy - General logic error

By Drupal Security Team on 21 May 2014 at 15:15 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-057
Project: Password policy (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: General logic error

SA-CONTRIB-2014-056 - Commerce Moneris - Information Disclosure

By Drupal Security Team on 21 May 2014 at 15:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-056
Project: Commerce Moneris (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-055 - Require Login - Access bypass

By Drupal Security Team on 21 May 2014 at 15:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-055
Project: Require Login (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-054 - Views - Access Bypass

By Drupal Security Team on 21 May 2014 at 14:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-054
Project: Views (third-party module)
Version: 7.x
Date: 2014-May-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-053 - Field API Tab Editor (FATE) - Access bypass

By Drupal Security Team on 14 May 2014 at 16:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-053
Project: Field API Tab Editor (third-party module)
Version: 7.x
Date: 2014-May-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-052 - AddressField Tokens - Cross Site Scripting (XSS)

By Drupal Security Team on 14 May 2014 at 15:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-052
Project: Addressfield Tokens (third-party module)
Version: 7.x
Date: 2014-May-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-051 - Realname Registration - Information Disclosure

By Drupal Security Team on 14 May 2014 at 15:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-051
Project: Realname registration (third-party module)
Version: 6.x, 7.x
Date: 2014-05-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-050 - Commerce Postfinance ePayment - Access Bypass

By Drupal Security Team on 14 May 2014 at 13:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-050
Project: Commerce Postfinance ePayment (third-party module)
Version: 7.x
Date: 2014-May-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-049 - Organic Groups (OG) - Access Bypass

By Drupal Security Team on 7 May 2014 at 18:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-049
Project: Organic groups (third-party module)
Version: 7.x
Date: 2014-May-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-048 - Field API Pane Editor (FAPE) - Access bypass

By Drupal Security Team on 30 Apr 2014 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-048
Project: Field API Pane Editor (FAPE) (third-party module)
Version: 7.x
Date: 2014-April-30
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-047 - Zen - Cross Site Scripting

By Drupal Security Team on 30 Apr 2014 at 15:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-047
Project: Zen (third-party theme)
Version: 7.x
Date: 2014-April-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-046 - Context Form Alteration - Cross Site Scripting (XSS)

By Drupal Security Team on 30 Apr 2014 at 13:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-046
Project: Context Form Alteration (third-party module)
Version: 7.x
Date: 2014-April-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-045 - Drupal Commons - Multiple Vulnerabilities

By Drupal Security Team on 23 Apr 2014 at 18:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-045
Project: Drupal Commons (third-party module)
Version: 7.x
Date: 2014-April-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-044 - Professional Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Apr 2014 at 17:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-044
Project: Professional Theme (third-party module)
Version: 7.x
Date: 2014-April-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-043 - Custom Search - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Apr 2014 at 15:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-043
Project: Custom Search (third-party module)
Version: 6.x, 7.x
Date: 2014-April-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-042 - Internationalization - Access Bypass

By Drupal Security Team on 23 Apr 2014 at 15:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-042
Project: Internationalization (third-party module)
Version: 7.x
Date: 2014-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2014-002 - Drupal core - Information Disclosure

By Drupal Security Team on 16 Apr 2014 at 19:50 UTC

Advisory ID: DRUPAL-SA-CORE-2014-002
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-April-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2014-041 - Block Search - SQL Injection

By Drupal Security Team on 16 Apr 2014 at 15:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-041
Project: Block Search (third-party module)
Version: 6.x
Date: 2014-April-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2014-040 - Skeleton theme - Cross Site Scripting

By Drupal Security Team on 9 Apr 2014 at 14:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-040
Project: Skeleton (third-party theme)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-038 - SimpleCorp theme - Cross Site Scripting

By Drupal Security Team on 9 Apr 2014 at 14:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-038
Project: SimpleCorp (third-party theme)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2014-039 - Revisioning - Access Bypass

By Drupal Security Team on 9 Apr 2014 at 14:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-039
Project: Revisioning (third-party module)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-037 - BlueMasters - Cross Site Scripting

By Drupal Security Team on 9 Apr 2014 at 14:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-037
Project: BlueMasters (third-party module)
Version: 7.x
Date: 2014-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS