Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

Boost - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-021

By Drupal Security Team on 13 Apr 2016 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-021
Project: Boost (third-party module)
Version: 7.x
Date: 2016-April-13
Security risk: 11/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Information Disclosure

Features - Less Critical - Denial of Service (DoS) - SA-CONTRIB-2016-020

By Drupal Security Team on 13 Apr 2016 at 15:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-020
Project: Features (third-party module)
Version: 7.x
Date: 2016-April-13
Security risk: 7/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Theoretical/TD:All
Vulnerability: Cross Site Request Forgery, Denial of Service

Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019

By Drupal Security Team on 6 Apr 2016 at 16:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-019
Project: Drupal Commerce (third-party module)
Version: 7.x
Date: 2016-April-06
Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default
Vulnerability: Information Disclosure

HybridAuth - Less critical - Multiple vulnerabilities - SA-CONTRIB-2016-018

By Drupal Security Team on 6 Apr 2016 at 15:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-018
Project: HybridAuth Social Login (third-party module)
Version: 7.x
Date: 2016-April-06
Security risk: 9/25 ( Less Critical) AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Information Disclosure, Open Redirect

Login one time - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-017

By Drupal Security Team on 23 Mar 2016 at 14:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-017
Project: Login one time (third-party module)
Version: 6.x, 7.x
Date: 2016-March-23
Security risk: 15/25 ( Critical) AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Fast Autocomplete - Critical - DOS vulnerability - SA-CONTRIB-2016-016

By Drupal Security Team on 16 Mar 2016 at 15:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-016
Project: Fast Autocomplete (third-party module)
Version: 7.x
Date: 2016-March-16
Security risk: 12/25 ( Moderately Critical) AC:None/A:None/CI:None/II:None/E:Theoretical/TD:All
Vulnerability: Denial of Service

Scald File - Critical - Remote Code Execution - SA-CONTRIB-2016-015

By Drupal Security Team on 9 Mar 2016 at 20:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-015
Project: Scald File Provider (third-party module)
Version: 7.x
Date: 2016-March-09
Security risk: 18/25 ( Critical) AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:All
Vulnerability: Arbitrary PHP code execution

Fieldable Panels Panes - Moderately Critical - Access Bypass - SA-CONTRIB-2016-014

By Drupal Security Team on 2 Mar 2016 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-014
Project: Fieldable Panels Panes (FPP) (third-party module)
Version: 7.x
Date: 2016-March-02
Security risk: 10/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Access bypass

Node Notify - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-013

By Drupal Security Team on 2 Mar 2016 at 14:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-013
Project: Node Notify (third-party module)
Version: 7.x
Date: 2016-March-02
Security risk: 18/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

Hubspot CTA - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-012 - Unsupported

By Drupal Security Team on 2 Mar 2016 at 14:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-012
Project: Hubspot CTA (third-party module)
Version: 7.x
Date: 2016-March-02
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Google Analytics Counter - Moderately Critical - CSRF - SA-CONTRIB-2016-011

By Drupal Security Team on 2 Mar 2016 at 14:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-011
Project: Google Analytics Counter (third-party module)
Version: 7.x
Date: 2016-March-02
Security risk: 12/25 ( Moderately Critical) AC:None/A:Admin/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Request Forgery

USASearch - Moderately Critical - Access Bypass - SA-CONTRIB-2016-010

By Drupal Security Team on 2 Mar 2016 at 14:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-010
Project: DigitalGov Search (machine name: USASearch) (third-party module)
Version: 7.x
Date: 2016-March-02
Security risk: 11/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:None/E:Proof/TD:All
Vulnerability: Access bypass

Prepopulate - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-009

By Drupal Security Team on 2 Mar 2016 at 13:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-009
Project: Prepopulate (third-party module)
Version: 7.x
Date: 2016-March-02
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: Multiple vulnerabilities

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001

By Drupal Security Team on 24 Feb 2016 at 17:33 UTC

Advisory ID: SA-CORE-2016-001
Project: Drupal core
Version: 6.x, 7.x, 8.x
Date: 2016-February-24
Security risk: 15/25 ( Critical) AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All
Vulnerability: Multiple vulnerabilities

FileField - Denial of Service - SA-CONTRIB-2016-008

By Drupal Security Team on 24 Feb 2016 at 15:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-008
Project: FileField (third-party module)
Version: 6.x
Date: 2016-February-24
Security risk: 11/25 ( Moderately Critical) AC:Complex/A:User/CI:None/II:Some/E:Proof/TD:All
Vulnerability: Denial of Service

Nodejs - Access bypass - Moderately Critical -- DRUPAL-SA-CONTRIB-2016-007

By Drupal Security Team on 17 Feb 2016 at 18:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-007
Project: Node.js integration (third-party module)
Version: 7.x, 8.x
Date: 2016-February-17
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All
Vulnerability: Information Disclosure

Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass - DRUPAL-SA-CONTRIB-2016-006

By Drupal Security Team on 17 Feb 2016 at 17:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-006
Project: Commerce Authorize.Net SIM/DPM Payment Methods (third-party module)
Version: 7.x
Date: 2016-February-17
Security risk: 15/25 ( Critical) AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Access bypass

CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005

By Drupal Security Team on 10 Feb 2016 at 21:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-005
Project: CAS (third-party module)
Version: 7.x
Date: 2016-February-10
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Proof/TD:All
Vulnerability: Information Disclosure

Embedded Media Field - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2016-004

By Drupal Security Team on 10 Feb 2016 at 21:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-004
Project: Embedded Media Field (third-party module)
Version: 6.x
Date: 2016-February-10
Security risk: 19/25 ( Critical) AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Open Atrium - Moderately Critical - Access Bypass - SA-CONTRIB-2016-003

By Drupal Security Team on 27 Jan 2016 at 16:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-003
Project: Open Atrium (third-party module)
Version: 7.x
Date: 2016-January-27
Security risk: 13/25 ( Moderately Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Access bypass

RedHen CRM - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-002

By Drupal Security Team on 13 Jan 2016 at 20:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-002
Project: RedHen CRM (third-party module)
Version: 7.x
Date: 2016-January-13
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting

Field Group - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-001

By Drupal Security Team on 6 Jan 2016 at 17:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2016-001
Project: Field Group (third-party module)
Version: 7.x
Date: 2016-January-06
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting

Block Class - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-175

By Drupal Security Team on 16 Dec 2015 at 19:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-175
Project: Block Class (third-party module)
Version: 7.x
Date: 2015-December-16
Security risk: 19/25 ( Critical) AC:None/A:Admin/CI:All/II:All/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Open Atrium - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-174

By Drupal Security Team on 16 Dec 2015 at 16:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-174
Project: Open Atrium (third-party module)
Version: 7.x
Date: 2015-December-16
Security risk: 17/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting

Select2 Field Widget - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-173

By Drupal Security Team on 16 Dec 2015 at 15:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-173
Project: Select2 Field Widget (third-party module)
Version: 7.x
Date: 2015-December-16
Security risk: 17/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross Site Scripting

Values - Critical - Arbitrary PHP code execution - SA-CONTRIB-2015-172

By Drupal Security Team on 16 Dec 2015 at 15:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-172
Project: Values (third-party module)
Version: 7.x
Date: 2015-December-16
Security risk: 16/25 ( Critical) AC:Basic/A:Admin/CI:All/II:All/E:Proof/TD:Uncommon
Vulnerability: Arbitrary PHP code execution

Drupal core - Critical - Remote installation - PSA-2015-001

Date:

2015-December-02

Advisory ID: DRUPAL-PSA-2015-001 (corrected from DRUPAL-PSA-CONTRIB-2015-001)
Project: Drupal core
Version: 6.x, 7.x, 8.x
Date: 2015-December-02
Security risk: 17/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Exploit/TD:Uncommon
Vulnerability: Multiple vulnerabilities

Token Insert Entity - Moderately Critical - Access bypass and information disclosure - SA-CONTRIB-2015-171

By Drupal Security Team on 2 Dec 2015 at 20:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-171
Project: Token Insert Entity (third-party module)
Version: 7.x
Date: 2015-December-02
Security risk: 10/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass, Information Disclosure

Apache Solr Search - Moderately Critical - Access Bypass - SA-CONTRIB-2015-170

By Drupal Security Team on 2 Dec 2015 at 19:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-170
Project: Apache Solr Search (third-party module)
Version: 6.x, 7.x
Date: 2015-December-02
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Proof/TD:Default
Vulnerability: Access bypass

Chat Room - Moderately Critical - Access Bypass - SA-CONTRIB-2015-169

By Drupal Security Team on 2 Dec 2015 at 17:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-169
Project: Chat Room (third-party module)
Version: 7.x
Date: 2015-December-02
Security risk: 11/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass

Mollom - Critical - Access bypass - SA-CONTRIB-2015-168

By Drupal Security Team on 2 Dec 2015 at 16:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-168
Project: Mollom (third-party module)
Version: 6.x
Date: 2015-December-02
Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Access bypass

RESTful - Less Critical - Access bypass - SA-CONTRIB-2015-167

By Drupal Security Team on 2 Dec 2015 at 16:15 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-167
Project: RESTful (third-party module)
Version: 7.x
Date: 2015-December-02
Security risk: 8/25 ( Less Critical) AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass

Encrypt - Moderately Critical - Weak Encryption - SA-CONTRIB-2015-166

By Drupal Security Team on 18 Nov 2015 at 20:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-166
Project: Encrypt (third-party module)
Version: 7.x
Date: 2015-November-18
Security risk: 11/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Weak Encryption

UC Profile - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-165

By Drupal Security Team on 11 Nov 2015 at 16:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-165
Project: UC Profile (third-party module)
Version: 6.x
Date: 2015-November-11
Security risk: 11/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Information Disclosure

MAYO theme - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-164

By Drupal Security Team on 11 Nov 2015 at 16:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-164
Project: MAYO (third-party theme)
Version: 7.x
Date: 2015-November-11
Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Monster Menus - Access Bypass - Moderately Critical - SA-CONTRIB-2015-163

By Drupal Security Team on 4 Nov 2015 at 17:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-163
Project: Monster Menus (third-party module)
Version: 7.x
Date: 2015-November-04
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass

Login Disable - Access Bypass - Moderately Critical - SA-CONTRIB-2015-162

By Drupal Security Team on 4 Nov 2015 at 16:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-162
Project: Login Disable (third-party module)
Version: 6.x, 7.x
Date: 2015-November-04
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: Access bypass

Field as Block - Less Critical - Information Disclosure - SA-CONTRIB-2015-161

By Drupal Security Team on 28 Oct 2015 at 15:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-161
Project: Field as Block (third-party module)
Version: 7.x
Date: 2015-October-28
Security risk: 8/25 ( Less Critical) AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Access bypass

Drupal Core - Overlay - Less Critical - Open Redirect - SA-CORE-2015-004

By Drupal Security Team on 21 Oct 2015 at 19:16 UTC

Advisory ID: DRUPAL-SA-CORE-2015-004
Project: Drupal core
Version: 7.x
Date: 2015-October-21
Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default
Vulnerability: Open Redirect

Webform CiviCRM Integration - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-160

By Drupal Security Team on 21 Oct 2015 at 19:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-160
Project: Webform CiviCRM Integration (third-party module)
Version: 7.x
Date: 2015-October-21
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: Cross Site Scripting

LABjs - Less Critical - Open Redirect - SA-CONTRIB-2015-159

By Drupal Security Team on 21 Oct 2015 at 16:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-159
Project: LABjs (third-party module)
Version: 7.x
Date: 2015-October-21
Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default
Vulnerability: Open Redirect

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-158

By Drupal Security Team on 21 Oct 2015 at 16:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-158
Project: jQuery Update (third-party module)
Version: 7.x
Date: 2015-October-21
Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default
Vulnerability: Open Redirect

Twilio - Moderately Critical - Access bypass - SA-CONTRIB-2015-157

By Drupal Security Team on 14 Oct 2015 at 20:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-157
Project: Twilio (third-party module)
Version: 7.x
Date: 2015-October-14
Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Access bypass

Colorbox - Access bypass - Less Critical - SA-CONTRIB-2015-156

By Drupal Security Team on 7 Oct 2015 at 16:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-156
Project: Colorbox (third-party module)
Version: 7.x
Date: 2015-October-07
Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All
Vulnerability: Access bypass

Entity Registration - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-155

By Drupal Security Team on 7 Oct 2015 at 15:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-155
Project: Entity Registration (third-party module)
Version: 7.x
Date: 2015-October-07
Security risk: 14/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: Information Disclosure

Stickynote - Cross Site Scripting (XSS) - Moderately Critical - SA-CONTRIB-2015-154

By Drupal Security Team on 7 Oct 2015 at 15:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-154
Project: stickynote (third-party module)
Version: 7.x
Date: 2015-October-07
Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross Site Scripting

Taxonomy Find - Unsupported - SA-CONTRIB-2015-153

By Drupal Security Team on 30 Sep 2015 at 20:16 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-153
Project: Taxonomy Find (third-party module)
Version: 6.x, 7.x
Date: 2015-September-30
Security risk: 13/25 ( Moderately Critical) AC:None/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: Cross Site Scripting

User Dashboard - SQL Injection - Critical - SA-CONTRIB-2015-152

By Drupal Security Team on 30 Sep 2015 at 20:13 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-152
Project: UserDashboard (third-party module)
Version: 7.x
Date: 2015-September-30
Security risk: 19/25 ( Critical) AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All
Vulnerability: SQL Injection

Scald - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-151

By Drupal Security Team on 16 Sep 2015 at 15:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-151
Project: Scald: Media Management made easy (third-party module)
Version: 7.x
Date: 2015-September-16
Security risk: 11/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: Information Disclosure

CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150

By Drupal Security Team on 16 Sep 2015 at 15:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2015-150
Project: CMS Updater (third-party module)
Version: 7.x
Date: 2015-September-16
Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:None/II:Some/E:Proof/TD:All
Vulnerability: Cross Site Scripting, Access bypass

Pages

Subscribe with RSS