Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2013-033 - Simple Corporate theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-033
Project: Simple Corporate (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-032 - Company theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-032
Project: Company theme (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-031 - Premium Responsive theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-031
Project: Premium Responsive (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-030 - Clean Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-030
Project: Clean Theme (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-029 - Business theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-029
Project: Business Theme (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-028 - Responsive Blog Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-028
Project: Responsive Blog (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-027 - Professional theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-027
Project: Professional (third-party theme)
Version: 7.x
Date: 2013-February-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-026 - Best Responsive Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-026
Project: Best Responsive (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-025 - Fresh Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-025
Project: Fresh theme (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-024 - Creative Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Feb 2013 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-024
Project: Creative Theme (third-party theme)
Version: 7.x
Date: 2013-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2013-002 - Drupal core - Denial of service

By Drupal Security Team on 20 Feb 2013 at 20:50 UTC

Advisory ID: DRUPAL-SA-CORE-2013-002
Project: Drupal core
Version: 7.x
Date: 2013-February-20
Security risk: Critical
Exploitable from: Remote
Vulnerability: Denial of service

SA-CONTRIB-2013-023 - Varnish module - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Feb 2013 at 20:43 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-023
Project: Varnish HTTP Accelerator Integration (third-party module)
Version: 6.x, 7.x
Date: 2013-February-20
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-022 - Menu Reference - Cross site scripting (XSS)

By Drupal Security Team on 20 Feb 2013 at 15:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-022
Project: Menu Reference (third-party module)
Version: 7.x
Date: 2013-February-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-021 - Display Suite - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Feb 2013 at 14:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-021
Project: Display Suite (third-party module)
Version: 7.x
Date: 2013-February-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-020 - Ubercart - Cross site scripting (XSS)

By Drupal Security Team on 20 Feb 2013 at 14:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-020
Project: Ubercart (third-party module)
Version: 7.x
Date: 2013-February-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-019 - Ubercart Views - Cross site scripting (XSS)

By Drupal Security Team on 20 Feb 2013 at 14:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-019
Project: Ubercart Views (third-party module)
Version: 6.x
Date: 2013-February-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-018 - Taxonomy Manager - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 20 Feb 2013 at 14:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-018
Project: Taxonomy Manager (third-party module)
Version: 6.x, 7.x
Date: 2013-February-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-017 - Yandex.Metrics - Cross site scripting (XSS)

By Drupal Security Team on 20 Feb 2013 at 14:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-017
Project: Yandex.Metrics (third-party module)
Version: 6.x, 7.x
Date: 2013-February-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-016 - Banckle Chat - Access bypass - Unsupported

By Drupal Security Team on 13 Feb 2013 at 16:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-016
Project: Banckle Chat (third-party module)
Version: 7.x
Date: 2013-February-13
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-015 - Manager Change for Organic Groups - Cross site scripting (XSS)

By Drupal Security Team on 13 Feb 2013 at 15:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-015
Project: Manager Change for Organic Groups (third-party module)
Version: 7.x
Date: 2013-February-13
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-014 - Drush Debian Packaging - Information Disclosure - Unsupported

By Drupal Security Team on 30 Jan 2013 at 17:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-014
Project: Drush Debian Packaging (third-party module)
Version: 7.x
Date: 2013-January-30
Security risk: Critical
Exploitable from: Local
Vulnerability: Information Disclosure

SA-CONTRIB-2013-013 - Boxes - Cross site scripting (XSS)

By Drupal Security Team on 30 Jan 2013 at 17:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-013
Project: Boxes (third-party module)
Version: 7.x
Date: 2013-January-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-012 - Google Authenticator login - Access Bypass

By Drupal Security Team on 30 Jan 2013 at 17:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-012
Project: Google Authenticator login (third-party module)
Version: 7.x
Date: 2013-January-30
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-011 - email2image - Access Bypass - Unsupported

By Drupal Security Team on 30 Jan 2013 at 16:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-011
Project: email2image (third-party module)
Version: 6.x
Date: 2013-January-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-010 - Search API sorts - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Jan 2013 at 17:15 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-010
Project: Search API sorts (third-party module)
Version: 7.x
Date: 2013-January-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-009 - Keyboard Shortcut Utility - Access Bypass - module unsupported

By Drupal Security Team on 23 Jan 2013 at 16:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-009
Project: Keyboard Shortcut Utility (third-party module)
Version: 7.x
Date: 2013-January-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-008 - CurvyCorners - Cross Site Scripting (XSS) - module unsupported

By Drupal Security Team on 23 Jan 2013 at 16:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-008
Project: CurvyCorners (third-party module)
Version: 6.x, 7.x
Date: 2013-January-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-007 User Relationships - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Jan 2013 at 16:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-007
Project: User Relationships (third-party module)
Version: 6.x, 7.x
Date: 2013-January-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-006 - Video - Arbitrary Code Execution

By Drupal Security Team on 23 Jan 2013 at 16:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-006
Project: Video (third-party module)
Version: 7.x
Date: 2013-January-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Arbitrary PHP code execution

SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 16 Jan 2013 at 22:07 UTC

Advisory ID: DRUPAL-SA-CORE-2013-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2013-January-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Access bypass

SA-CONTRIB-2013-005 - Mark Complete Module - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 16 Jan 2013 at 20:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-005
Project: Mark Complete (third-party module)
Version: 7.x
Date: 2013-January-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-004 - Live CSS - Arbitrary Code Execution

By Drupal Security Team on 16 Jan 2013 at 16:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-004
Project: Live CSS (third-party module)
Version: 6.x, 7.x
Date: 2012-January-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary PHP code execution

SA-CONTRIB-2013-003 - RESTful Web Services - Cross site request forgery (CSRF)

By Drupal Security Team on 16 Jan 2013 at 14:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-003
Project: RESTful Web Services (third-party module)
Version: 7.x
Date: 2013-January-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-002 - Payment - Access Bypass

By Drupal Security Team on 9 Jan 2013 at 16:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-002
Project: Payment (third-party module)
Version: 7.x
Date: 2013-January-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-001 - Search API - Cross Site Scripting

By Drupal Security Team on 9 Jan 2013 at 15:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-001
Project: Search API (third-party module)
Version: 7.x
Date: 2013-January-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2012-004 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 19 Dec 2012 at 18:46 UTC

Advisory ID: DRUPAL-SA-CORE-2012-004
Project: Drupal core
Version: 6.x, 7.x
Date: 2012-December-19
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Arbitrary PHP code execution

SA-CONTRIB-2012-174 - Context - Information Disclosure

By Drupal Security Team on 19 Dec 2012 at 18:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-174
Project: Context (third-party module)
Version: 6.x, 7.x
Date: 2012-12-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-173 - Nodewords: Information disclosure

By Drupal Security Team on 5 Dec 2012 at 17:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-173
Project: Nodewords: D6 Meta Tags (third-party module)
Version: 6.x
Date: 2012-December-05
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-172 - Zero Point - Cross Site Scripting (XSS)

By Drupal Security Team on 28 Nov 2012 at 22:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-172
Project: Zero Point (third-party module)
Version: 6.x, 7.x
Date: 2012-November-28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-171 - Webmail Plus - SQL injection - (unsupported)

By Drupal Security Team on 28 Nov 2012 at 20:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-171
Project: Webmail Plus (third-party module)
Version: 6.x
Date: 2012-November-28
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2012-170 - MultiLink - Access Bypass

By Drupal Security Team on 28 Nov 2012 at 20:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-170
Project: Multi-Language Link and Redirect (MultiLink) (third-party module)
Version: 6.x, 7.x
Date: 2012-November-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-169 - Email Field - Cross Site Scripting and Access bypass

By Drupal Security Team on 28 Nov 2012 at 19:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-169
Project: Email Field (third-party module)
Version: 6.x
Date: 2012-11-28
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Access bypass

SA-CONTRIB-2012-168 - Services - Information Disclosure

By Drupal Security Team on 28 Nov 2012 at 19:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-168
Project: Services (third-party module)
Version: 6.x, 7.x
Date: 2012-11-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-167 - Mixpanel - Cross site scripting (XSS)

By Drupal Security Team on 28 Nov 2012 at 19:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-167
Project: Mixpanel (third-party module)
Version: 6.x
Date: 2012-November-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-166 - Table of Contents - Access Bypass

By Drupal Security Team on 14 Nov 2012 at 21:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-166
Project: Table of Contents (third-party module)
Version: 6.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Nov 2012 at 20:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-165
Project: Chaos tool suite (ctools) (third-party module)
Version: 6.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-164 - Smiley module and Smileys module - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Nov 2012 at 19:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-164
Project: Smiley (third-party module)
Project: Smileys (third-party module)
Version: 6.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-163 - User Read-Only - Permission escalation

By Drupal Security Team on 14 Nov 2012 at 19:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-163
Project: User Read-Only (third-party module)
Version: 6.x, 7.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)

By Drupal Security Team on 14 Nov 2012 at 16:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-162
Project: RESTful Web Services (third-party module)
Version: 7.x
Date: 2012-November-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-161 - Webform CiviCRM Integration - Access Bypass

By Drupal Security Team on 7 Nov 2012 at 21:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-161
Project: Webform CiviCRM Integration (third-party module)
Version: 7.x
Date: 2012-November-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

Pages

Subscribe with RSS