Security advisories | Drupal.org

Project: PHP
Version: PHP 4 < 4.4.3, PHP 5 < 5.1.4
Security risk: Critical
Exploitable from: Remote
Vulnerability: unset() hash / index collision exploit using Drupal (CVE-2006-3017)

Description

SA-2007-022 - Boost - file overwrite

By bjaspan on 3 Oct 2007 at 19:10 UTC

Advisory ID: DRUPAL-SA-2007-022.
Project: Boost (third-party module)
Version: 4.7.x-1.*, 5.x-0.*
Date: 2007-10-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Filesystem overwrite

SA-2007-021: Project issue tracking - XSS vulnerabilities in subscription forms.

By hunmonk on 3 Oct 2007 at 17:39 UTC

Advisory ID: DRUPAL-SA-2007-021.
Project: Project issue tracking (third-party module)
Version: 4.7.x-1.x, 4.7.x-2.x, 5.x-1.x
Date: 2007-Sep-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting (XSS)

Project and Project issue tracking - Access bypass

By dww on 19 Aug 2007 at 23:14 UTC

Advisory ID: DRUPAL-SA-2007-020.
Project: Project and Project issue tracking (third-party modules)
Version: 4.7.x-1.*, 4.7.x-2.*, 5.x-0.*
Date: 2007-Aug-20
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Content Construction Kit - Cross site scripting

By heine on 13 Aug 2007 at 19:35 UTC

Advisory ID: DRUPAL-SA-2007-019
Project: Content Construction Kit (CCK) (third-party module)
Version: 4.7.x-1.x, 5.x-1.x
Date: 2007-August-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

Drupal core - Multiple cross site scripting vulnerabilities

By heine on 26 Jul 2007 at 18:59 UTC

Advisory ID: DRUPAL-SA-2007-018
Project: Drupal core
Version: 4.7.x, 5.x
Date: 2007-July-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple cross site scripting vulnerabilities

Drupal core - Cross site request forgeries

By heine on 26 Jul 2007 at 18:58 UTC

Advisory ID: DRUPAL-SA-2007-017
Project: Drupal core
Version: 5.x
Date: 2007-July-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple cross site request forgeries

LoginToboggan - Cross site scripting

By dww on 12 Jul 2007 at 20:45 UTC

Advisory ID: DRUPAL-SA-2007-016
Project: LoginToboggan (third-party module)
Version: 4.7.x-1.0, 4.7.x-1.x-dev, 5.x-1.x-dev
Date: 2007-07-12
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

Forward - Access bypass

By ajk on 9 Jul 2007 at 22:02 UTC

Advisory ID: DRUPAL-SA-2007-015
Project: Forward (third-party module)
Version: 5.x and 4.7.x
Date: 2007-July-09
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Print - Access bypass

By ajk on 9 Jul 2007 at 21:46 UTC

Advisory ID: DRUPAL-SA-2007-014
Project: Print (third-party module)
Version: 5.x and 4.7.x
Date: 2007-July-09
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Multiple vulnerabilities in Database Administration (dba) module

By dww on 11 Apr 2007 at 22:05 UTC

Advisory ID: DRUPAL-SA-2007-013.
Project: Database Administration (third-party module).
Version: 4.6.x-1.*, 4.7.x-1.*.
Date: 2007-April-11.
Security risk: Critical.
Exploitable from: Remote.
Vulnerability: Cross site scripting and cross site request forgery.

Project issue tracking - Access bypass

By dww on 8 Mar 2007 at 08:00 UTC

Advisory ID: DRUPAL-SA-2007-012.
Project: Project issue tracking (third-party module).
Version: 4.7.x-1.*, 4.7.x-2.*, 5.x-0.*.
Date: 2007-March-08.
Security risk: Critical.
Exploitable from: Remote.
Vulnerability: Access bypass.

Nodefamily - Access bypass

By heine on 6 Mar 2007 at 20:25 UTC

Advisory ID: DRUPAL-SA-2007-011
Project: Node familty (third-party module)
Version: 5.x
Date: 2007-March-6
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Secure site - Access bypass

By heine on 16 Feb 2007 at 03:12 UTC

Advisory ID: DRUPAL-SA-2007-010
Project: Secure site (third-party module)
Version: 4.7, 5
Date: 2007-Feb-16
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

getID3 library and Audio, Mediafield - arbitrary code execution

By heine on 16 Feb 2007 at 01:21 UTC

Advisory ID: DRUPAL-SA-2007-009.
Project: getID3 (third-party library) used by Audio and Mediafield
Version: getID3 1.7.1
Date: 2007-Feb-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

Image pager - Cross site scripting

By heine on 15 Feb 2007 at 09:24 UTC

Advisory ID: DRUPAL-SA-2007-008
Project: Image Pager (third-party module)
Version: 4.7.x-1.x-dev, 5.x-1.x-dev
Date: 2007-02-15
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

Textimage - response validation bypass

By heine on 31 Jan 2007 at 09:59 UTC

Advisory ID: DRUPAL-SA-2007-007
Project: Textimage (third-party module)
Version: 4.7.x, 5.x
Date: 2007-Jan-31
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Captcha bypass

Captcha - response validation bypass

By heine on 30 Jan 2007 at 21:43 UTC

Advisory ID: DRUPAL-SA-2007-006
Project: Captcha (third-party module)
Version: 4.7.x, 5.x
Date: 2007-Jan-30
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Captcha bypass

DRUPAL-SA-2007-005 - Drupal core - Arbitrary code execution

By heine on 29 Jan 2007 at 19:11 UTC

Advisory ID: DRUPAL-SA-2007-005
Project: Drupal core
Version: 4.7.x, 5.x
Date: 2007-Jan-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

Project and Project issue tracking - Multiple vulnerabilities

By dww on 23 Jan 2007 at 21:04 UTC

Advisory ID: DRUPAL-SA-2007-004.
Project: Project and Project issue tracking (third party modules).
Date: 2007-Jan-23.
Security risk: Moderately critical.
Exploitable from: Remote.
Vulnerability: Access bypass, Cross site scripting, and unsafe file upload handling.