Show advisories for only Drupal Core, only contributed projects, or only PSAs

DRUPAL-SA-2006-024 - Drupal core - Multiple cross site scripting vulnerabilities

By heine on
  • Advisory ID: DRUPAL-SA-2006-024
  • Project: Drupal core
  • Date: 2006-Oct-18
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting
⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

IMCE file handling vulnerabilities

By heine on
  • Advisory ID: DRUPAL-SA-2006-023
  • Project: IMCE
  • Date: 2006-October-02
  • Security risk: highly critical
  • Exploitable from: remote
  • Vulnerability: file handling

Search Keywords cross site scripting vulnerability

By heine on
  • Advisory ID: DRUPAL-SA-2006-022
  • Project: Search Keywords
  • Date: 2006-Sep-20
  • Security risk: moderately critical
  • Exploitable from: remote
  • Vulnerability: cross site scripting

Site Profile Directory cross site scripting vulnerability

By heine on
  • Advisory ID: DRUPAL-SA-2006-021
  • Project: Site Profile Directory
  • Date: 2006-Sep-20
  • Security risk: less critical
  • Exploitable from: remote
  • Vulnerability: cross site scripting

Userreview cross site scripting vulnerability

By heine on
  • Advisory ID: DRUPAL-SA-2006-020
  • Project: Userreview
  • Date: 2006-Sep-13
  • Security risk: less critical
  • Exploitable from: remote
  • Vulnerability: cross site scripting

Pubcookie security bypass

By heine on
  • Advisory ID: DRUPAL-SA-2006-019
  • Project: Pubcookie 4.6, 4.7
  • Date: 2006-Sep-8
  • Security risk: highly critical
  • Exploitable from: remote
  • Vulnerability: security bypass

Pathauto cross site scripting vulnerability

By heine on
  • Advisory ID: DRUPAL-SA-2006-018
  • Project: Pathauto 4.6, 4.7
  • Date: 2006-Sep-05
  • Security risk: less critical
  • Exploitable from: remote
  • Vulnerability: Cross site scripting

Easylinks multiple vulnerabilities

By heine on
  • Advisory ID: DRUPAL-SA-2006-017
  • Project: Easylinks 4.7
  • Date: 2006-Aug-22
  • Security risk: highly critical
  • Exploitable from: remote
  • Vulnerability: SQL injection, Cross site scripting

E-commerce Cross site scripting vulnerability

By heine on
  • Advisory ID: DRUPAL-SA-2006-016
  • Project: E-commerce 4.7
  • Date: 2006-Aug-22
  • Security risk: less critical
  • Exploitable from: remote
  • Vulnerability: Multiple Cross site scripting

DRUPAL-SA-2006-015: Multiple vulnerabilities in Bibliography

By heine on
  • Advisory ID: DRUPAL-SA-2006-015
  • Project: Bibliography
  • Date: 2006-Aug-08
  • Security risk: highly critical
  • Exploitable from: remote
  • Vulnerability: SQL injection, Cross site scripting

Revision to DRUPAL-SA-2006-013 - Recipe

By heine on
  • Advisory ID: DRUPAL-SA-2006-014
  • Project: Recipe 4.6
  • Date: 2006-Aug-08
  • Security risk: less critical
  • Exploitable from: remote
  • Vulnerability: Cross site scripting

DRUPAL-SA-2006-013: Recipe module

By gerhard killesreiter on
  • Advisory ID: DRUPAL-SA-2006-013
  • Project: Recipe
  • Date: 2006-Aug-07
  • Security risk: less critical
  • Exploitable from: remote
  • Vulnerability: Cross site scripting

DRUPAL-SA-2006-012: Jobsearch module

By gerhard killesreiter on
  • Advisory ID: DRUPAL-SA-2006-012
  • Project: Job Search
  • Date: 2006-Aug-07
  • Security risk: highly critical
  • Exploitable from: remote
  • Vulnerability: SQL injection

DRUPAL-SA-2006-011 XSS Vulnerability in user module

By gerhard killesreiter on
  • Advisory ID: DRUPAL-SA-2006-011
  • Project: Drupal core
  • Date: 2006-Aug-2
  • Security risk: less critical
  • Impact: Drupal core
  • Exploitable from: remote
  • Vulnerability: cross-site scripting
⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

XSS vulnerability in webform module

By chx on
  • Advisory ID: DRUPAL-SA-2006-010
  • Project: webform
  • Date: 2006-Jul-09
  • Security risk: critical
  • Impact: webform
  • Exploitable from: remote
  • Vulnerability: multiple cross-site scripting

Form_mail module allows arbitrary header injection

By chx on
  • Advisory ID: DRUPAL-SA-2006-009
  • Project: form_mail
  • Date: 2006-Jul-4
  • Security risk: moderately critical
  • Impact: security bypass
  • Exploitable from: remote
  • Vulnerability: mail header injection attack

DRUPAL-SA-2006-008 XSS Vulnerability in taxonomy module

By webchick on
  • Advisory ID: DRUPAL-SA-2006-008
  • Project: Drupal core
  • Date: 2006-Jun-01
  • Security risk: less critical
  • Impact: Drupal core
  • Exploitable from: remote
  • Vulnerability: cross-site scripting
⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

SA-2006-007 - Drupal Core - Revision to DRUPAL-SA-2006-006

By webchick on
  • Advisory ID: DRUPAL-SA-2006-007
  • Project: Drupal core and potentially any web application that accepts uploads.
  • Date: 2006-Jun-01
  • Security risk: highly critical
  • Impact: Drupal core
  • Exploitable from: remote
  • Vulnerability: Execution of arbitrary files
⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations

By webchick on
  • Advisory ID: DRUPAL-SA-2006-006
  • Project: Drupal core
  • Date: 2006-May-24
  • Security risk: highly critical
  • Impact: Drupal core
  • Exploitable from: remote
  • Vulnerability: Execution of arbitrary files
⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

DRUPAL-SA-2006-005 - Drupal core - SQL injection vulnerability

By chx on
  • Advisory ID: DRUPAL-SA-2006-005
  • Project: Drupal core
  • Date: 2006-May-18
  • Security risk: highly critical
  • Impact: Drupal core
  • Exploitable from: remote
  • Vulnerability: SQL injection
⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

XSS vulnerability in project module

By dries on
  • Project: project module (contributed module)
  • Security risk: less critical
  • Impact: project module
  • Where: from remote
  • Vulnerability: malicious HTML execution and XSS attacks

DRUPAL-SA-2006-004 Mail header injection vulnerability

By jvandyk on
  • Advisory ID: DRUPAL-SA-2006-004
  • Project: Drupal core
  • Date: 2006-03-13
  • Security risk: moderately critical
  • Impact: security bypass
  • Where: from remote
  • Vulnerability: mail header injection attack
⋅ Categories: Drupal 4.5.x or older, Drupal 4.6.x

DRUPAL-SA-2006-003 Session fixation vulnerability

By jvandyk on
  • Advisory ID: DRUPAL-SA-2006-003
  • Project: Drupal core
  • Date: 2006-03-13
  • Security risk: less critical
  • Impact: hijacking
  • Where: from remote
  • Vulnerability: session fixation attack
⋅ Categories: Drupal 4.5.x or older, Drupal 4.6.x

DRUPAL-SA-2006-002 XSS vulnerabilities

By jvandyk on
  • Advisory ID: DRUPAL-SA-2006-002
  • Project: Drupal core
  • Date: 2006-03-13
  • Security risk: less critical
  • Impact: cross-site scripting
  • Where: from remote
  • Vulnerability: cross-site scripting
⋅ Categories: Drupal 4.5.x or older, Drupal 4.6.x

DRUPAL-SA-2006-001 Security bypass in menu.module

By jvandyk on
  • Advisory ID: DRUPAL-SA-2006-001
  • Project: Drupal core
  • Date: 2006-03-13
  • Security risk: less critical
  • Impact: security bypass
  • Where: from remote
  • Vulnerability: bypass access control
⋅ Categories: Drupal 4.5.x or older, Drupal 4.6.x

False Drupal XSS alarm on BugTraq - PSA-2006-001

Date: 
2006-January-04

Someone under the pseudonym "Liz0ziM" sent a false security alarm to BugTraq without first contacting the security team:

http://www.securityfocus.com/archive/1/420671/30/0/threaded

This vulnerability is fixed in Drupal 4.5.6, 4.6.4 and onwards. Drupal's new XSS filter mechanism takes care of all vulnerabilities listed on http://ha.ckers.org/xss.html (and even more).

DRUPAL-SA-2005-009 Bypass "view user profiles" permission

By dries on
  • Advisory ID: DRUPAL-SA-2005-009
  • Project: Drupal core
  • Date: 2005-11-30
  • Security risk: not critical
  • Impact: normal
  • Where: from remote
  • Vulnerability: bypass access control
⋅ Categories: Drupal 4.6.x

DRUPAL-SA-2005-008 XSS and HTTP header injection vulnerability with uploaded files

By dries on
  • Advisory ID: DRUPAL-SA-2005-008
  • Project: Drupal core
  • Date: 2005-11-30
  • Security risk: less critical
  • Impact: normal
  • Where: from remote
  • Vulnerability: XSS, HTTP header injection
⋅ Categories: Drupal 4.5.x or older, Drupal 4.6.x

DRUPAL-SA-2005-007 XSS vulnerability in submitted content

By dries on
  • Advisory ID: DRUPAL-SA-2005-007
  • Project: Drupal core
  • Date: 2005-11-30
  • Security risk: less critical
  • Impact: normal
  • Where: from remote
  • Vulnerability: XSS
⋅ Categories: Drupal 4.5.x or older, Drupal 4.6.x

Unintentionally logging credit card transactions

By chx on
  • Advisory ID: DRUPAL-SA-2005-006
  • Project: ecommerce
  • Date: 2005-Oct-30
  • Security risk: critical
  • Impact: authorize_net module, which is a part of the ecommerce package
  • Exploitable from: local
  • Vulnerability: System is unintentionally logging credit card transactions, including card numbers.

SQL injection and PHP code execution

By chx on
  • Advisory ID: DRUPAL-SA-2005-005
  • Project: flexinode
  • Date: 2005-Oct-03
  • Security risk: highly critical
  • Impact: flexinode module
  • Exploitable from: remote
  • Vulnerability: SQL injection and PHP execution by bypassing input format check

Pages

Subscribe with RSS Subscribe to Security advisories