Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2012-138 - Exposed Filter Data - Cross Site Scripting (XSS)

By Drupal Security Team on 5 Sep 2012 at 19:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-138
Project: Exposed Filter Data (third-party module)
Version: 6.x
Date: 2012-September-05
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-137 - Heartbeat - Cross Site Request Forgery (CSRF) in heartbeat_comments

By Drupal Security Team on 5 Sep 2012 at 17:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-137
Project: Heartbeat (third-party module)
Version: 6.x, 7.x
Date: 2012-September-5
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-136 - Apache Solr Search Autocomplete - Cross Site Scripting (XSS)

By Drupal Security Team on 29 Aug 2012 at 21:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-136
Project: Apache Solr Autocomplete (third-party module)
Version: 6.x, 7.x
Date: 2012-August-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-135 - CAPTCHA - Insufficient anti-automation prevention

By Drupal Security Team on 29 Aug 2012 at 18:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-135
Project: CAPTCHA (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-134 - Views - Privilege Escalation

By Drupal Security Team on 29 Aug 2012 at 18:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-134
Project: Views (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Critical
Exploitable from: Remote
Vulnerability: Privilege escalation

SA-CONTRIB-2012-133 - Taxonomy Image - Cross Site Scripting (XSS) & Arbitrary PHP code execution

By Drupal Security Team on 29 Aug 2012 at 18:10 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-133
Project: Taxonomy Image (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Arbitrary PHP code execution

SA-CONTRIB-2012-132 - Announcements - Access Bypass

By Drupal Security Team on 29 Aug 2012 at 18:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-132
Project: Announcements (third-party module)
Version: 6.x
Date: 2012-August-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-131 - Email Field - Access Bypass

By Drupal Security Team on 29 Aug 2012 at 18:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-131
Project: Email Field (third-party module)
Version: 6.x, 7.x
Date: 2012-August-29
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-130 - Jstool - Multiple Vulnerabilities

By Drupal Security Team on 29 Aug 2012 at 15:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-130
Project: Javascript Tool (third-party module)
Version: 7.x
Date: 2012-August-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2012-129 - Activism - Access Bypass

By Drupal Security Team on 29 Aug 2012 at 14:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-129
Project: Activism (third-party module)
Version: 6.x
Date: 2012-08-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2012-128 - Elegant Theme - Cross Site Scripting (XSS)

By Drupal Security Team on 15 Aug 2012 at 17:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-128
Project: Elegant Theme (third-party module)
Version: 7.x
Date: 2012-August-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-127 - Custom Publishing Options - Cross Site Scripting (XSS) Vulnerability

By Drupal Security Team on 15 Aug 2012 at 16:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-127
Project: Custom Publishing Options (third-party module)
Version: 6.x
Date: 2012-August-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-126 - Hotblocks - Cross Site Scripting (XSS) and Denial of Service (DoS)

By Drupal Security Team on 15 Aug 2012 at 16:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-126
Project: HotBlocks (third-party module)
Version: 6.x
Date: 2012-August-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Multiple vulnerabilities

SA-CONTRIB-2012-125 - Chaos tool suite (ctools) - Local File Inclusion and Cross Site Scripting (XSS)

By Drupal Security Team on 8 Aug 2012 at 18:12 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-125
Project: Chaos tool suite (ctools) (third-party module)
Version: 6.x, 7.x
Date: 2012-August-8
Security risk: Critical
Exploitable from: Remote
Vulnerability: Local File Inclusion and Cross Site Scripting

SA-CONTRIB-2012-124 - Mime Mail - Access Bypass

By Drupal Security Team on 8 Aug 2012 at 17:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-124
Project: Mime Mail (third-party module)
Version: 6.x
Date: 2012-August-8
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-123 - Shibboleth authentication - Access Bypass

By Drupal Security Team on 8 Aug 2012 at 17:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-123
Project: Shibboleth authentication (third-party module)
Version: 6.x
Date: 2012-August-8
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-122 - Better Revisions - Cross Site Scripting (XSS)

By Drupal Security Team on 8 Aug 2012 at 16:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-122
Project: Better Revisions (third-party module)
Version: 7.x
Date: 2012-August-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-121 - Shorten URLs - Cross Site Scripting (XSS)

By Drupal Security Team on 8 Aug 2012 at 15:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-121
Project: Shorten URLs (third-party module)
Version: 6.x, 7.x
Date: 2012-August-8
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-120 - Monthly Archive by Node Type - Access Bypass (unsupported)

By Drupal Security Team on 1 Aug 2012 at 15:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-120
Project: Monthly Archive by Node Type (third-party module)
Version: 6.x
Date: 2012-August-1
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-119 - Excluded Users - Cross Site Scripting (XSS)

By Drupal Security Team on 1 Aug 2012 at 13:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-119
Project: Excluded Users (third-party module)
Version: 6.x
Date: 2012-August-1
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-118 - Secure Login - Open Redirect

By Drupal Security Team on 25 Jul 2012 at 19:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-118
Project: Secure Login (third-party module)
Version: 7.x
Date: 2012-July-25
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Open Redirect

SA-CONTRIB-2012-117 - Location - Access Bypass

By Drupal Security Team on 25 Jul 2012 at 19:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-117
Project: Location (third-party module)
Version: 6.x, 7.x
Date: 2012-July-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-116 - Subuser - Cross Site Request Forgery (CSRF) and Access Bypass

By Drupal Security Team on 25 Jul 2012 at 19:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-116
Project: Subuser (third-party module)
Version: 6.x
Date: 2012-July-25
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Request Forgery

SA-CONTRIB-2012-115 - Gallery formatter - Cross Site Scripting (XSS)

By Drupal Security Team on 25 Jul 2012 at 19:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-115
Project: Gallery formatter (third-party module)
Version: 7.x
Date: 2012-July-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-114 - Campaign Monitor - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Jul 2012 at 15:25 UTC

Advisory ID: SA-CONTRIB-2012-114
Project: Campaign Monitor (third-party module)
Version: 6.x
Date: 2012-July-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-113 - Drupal Commons - Access Bypass

By Drupal Security Team on 11 Jul 2012 at 21:53 UTC

Advisory ID: SA-CONTRIB-2012-113
Project: Drupal Commons (third-party module)
Version: 6.x
Date: 2012-July-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-112 - Ubercart SecureTrading - Failure to follow guideline/specification

By Drupal Security Team on 11 Jul 2012 at 20:40 UTC

Advisory ID: SA-CONTRIB-2012-112
Project: Ubercart SecureTrading Payment Method (third-party module)
Version: 6.x
Date: 2012-July-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Failure to follow guideline/specification - integrity check value

SA-CONTRIB-2012-111 - Security Questions - Access Bypass

By Drupal Security Team on 11 Jul 2012 at 15:59 UTC

Advisory ID: SA-CONTRIB-2012-111
Project: Security Questions (third-party module)
Version: 6.x, 7.x
Date: 2012-July-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-110 - Colorbox Node - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Jul 2012 at 15:18 UTC

Advisory ID: SA-CONTRIB-2012-110
Project: Colorbox Node (third-party module)
Version: 7.x
Date: 2012-July-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-109 - Restrict node page view - Access bypass

By Drupal Security Team on 11 Jul 2012 at 15:06 UTC

Advisory ID: SA-CONTRIB-2012-109
Project: Restrict node page view (third-party module)
Version: 7.x
Date: 2012-July-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-108 - Drag & Drop Gallery - Arbitrary PHP code execution

By Drupal Security Team on 11 Jul 2012 at 14:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-108
Project: Drag & Drop Gallery (third-party module)
Version: 6.x
Date: 2012-July-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Access bypass, Cross Site Request Forgery, SQL Injection, Arbitrary PHP code execution

SA-CONTRIB-2012-107 - Search autocomplete - Access bypass

By Drupal Security Team on 11 Jul 2012 at 14:34 UTC

Advisory ID: SA-CONTRIB-2012-107
Project: Search Autocomplete (third-party module)
Version: 7.x
Date: 2012-July-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-106 - Listhandler - Access Bypass

By Drupal Security Team on 11 Jul 2012 at 14:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-106
Project: Listhandler (third-party module)
Version: 6.x
Date: 2012-July-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-105 - Hashcash - Cross Site Scripting (XSS)

By Drupal Security Team on 27 Jun 2012 at 20:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-105
Project: Hashcash (third-party module)
Version: 6.x, 7.x
Date: 2012-June-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-104 - Privatemsg - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Jun 2012 at 17:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-104
Project: Privatemsg (third-party module)
Version: 7.x
Date: 2012-June-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-103 - Global Redirect - Open Redirect

By Drupal Security Team on 13 Jun 2012 at 20:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-103
Project: Global Redirect (third-party module)
Version: 6.x, 7.x
Date: 2012-June-13
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Open Redirect

SA-CONTRIB-2012-102 - Ubercart AJAX Cart - Potential Disclosure of user Session ID

By Drupal Security Team on 13 Jun 2012 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-102
Project: Ubercart AJAX Cart (third-party module)
Version: 6.x
Date: 2012-June-13
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-101 - Protected Node - Access Bypass

By Drupal Security Team on 13 Jun 2012 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-101
Project: Protected node (third-party module)
Version: 6.x
Date: 2012-June-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-100 - SimpleMeta - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 13 Jun 2012 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-100
Project: SimpleMeta (third-party module)
Version: 6.x
Date: 2012-June-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-099 - Node Hierarchy - Cross Site Request Forgery (CSRF)

By Drupal Security Team on 13 Jun 2012 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-099
Project: Node Hierarchy (third-party module)
Version: 6.x
Date: 2012-June-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2012-098 - Janrain Capture - Open Redirect

By Drupal Security Team on 13 Jun 2012 at 18:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-098
Project: Janrain Capture (third-party module)
Version: 6.x, 7.x
Date: 2012-June-13
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Open Redirect

SA-CONTRIB-2012-097 - Protest - Cross Site Scripting (XSS)

By Drupal Security Team on 6 Jun 2012 at 20:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-097
Project: Protest (third-party module)
Version: 6.x, 7.x
Date: 2012-June-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-096 - Authoring HTML - Cross Site Scripting (XSS)

By Drupal Security Team on 6 Jun 2012 at 19:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-096
Project: Authoring HTML (third-party module)
Version: 6.x
Date: 2012-June-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2012-095 - Simplenews - Information Disclosure

By Drupal Security Team on 6 Jun 2012 at 19:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-095
Project: Simplenews (third-party module)
Version: 6.x, 7.x
Date: 2012-June-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2012-094 - Maestro module - Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS)

By Drupal Security Team on 6 Jun 2012 at 19:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-094
Project: Maestro (third-party module)
Version: 7.x
Date: 2012-June-06
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2012-093 - Node Embed - Access Bypass

By Drupal Security Team on 6 Jun 2012 at 19:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-093
Project: Node Embed (third-party module)
Version: 6.x, 7.x
Date: 2012-June-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-092 - Organic Groups - Cross Site Scripting (XSS) and Access Bypass

By Drupal Security Team on 6 Jun 2012 at 19:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-092
Project: Organic groups (third-party module)
Version: 6.x
Date: 2012-June-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Access bypass

SA-CONTRIB-2012-091 - Token Authentication - Access bypass

By Drupal Security Team on 6 Jun 2012 at 19:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-091
Project: Tokenauth (third-party module)
Version: 6.x
Date: 2012-June-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2012-090 - File depot - Session Management Vulnerability

By Drupal Security Team on 30 May 2012 at 18:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-090
Project: filedepot (third-party module)
Version: 6.x
Date: 2012-May-30
Security risk: Critical
Exploitable from: remote
Vulnerability: Access bypass

SA-CONTRIB-2012-089 - Counter - SQL Injection (unsupported)

By Drupal Security Team on 30 May 2012 at 18:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-089
Project: Counter (third-party module)
Version: 6.x
Date: 2012-May-30
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: SQL Injection

Pages

Subscribe with RSS