SA-CONTRIB-2009-045: Moderation - Cross Site Request Forgery

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-045
  • Project: Moderation (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-07-22
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2009-044 - Bubbletimer - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-044
  • Project: Bubbletimer (third-party module)
  • Version: 6.x
  • Date: 2009-July-22
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-043 - Image Assist - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-043
  • Project: Image Assist (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-07-15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting, Information disclosure

SA-CONTRIB-2009-042 - Submitted By - Cross Site Scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-042
  • Project: Submitted By (third-party module)
  • Version: 6.x
  • Date: 2009-July-15
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-041 - Nodequeue - Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-041
  • Project: Nodequeue (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-July-08
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2009-040 - Advanced Forum - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-040
  • Project: Advanced Forum (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-July-1
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CORE-2009-007 - Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CORE-2009-007
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-July-1
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-039 - Links Package - Cross Site Scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-039
  • Project: Links Package (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-June-25
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-038 - Nodequeue - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-038
  • Project: Nodequeue (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-June-10
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-037 - Views - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-037
  • Project: Views
  • Versions: 6.x-2.x
  • Date: 2009-June-10
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting (XSS), Access Bypass

SA-CONTRIB-2009-036 - Services - Impersonation

  • Advisory ID: SA-CONTRIB-2009-036
  • Project: Services (third-party module)
  • Version: 6.x
  • Date: 2009 June 10
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Impersonation

SA-CONTRIB-2009-035 - Booktree - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-035
  • Project: Booktree (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-June-10
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-034 - Taxonomy manager - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-034
  • Project: Taxonomy manager (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-June-10
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-033 - Quiz - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-033
  • Project: Quiz (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-June-03
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-032 - Webform - Cross-site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-032
  • Project: Webform (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009-June-03
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting

SA-CONTRIB-2009-031 - Ajax Session - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-031
  • Project: Ajax Session (third-party module)
  • Version: 5.x
  • Date: 2009 May 27
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-030 - Email Verification - Information disclosure / Cross Site Scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-030
  • Project: Email Verification (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-May-20
  • Security risk: High
  • Exploitable from: Remote
  • Vulnerability: Information disclosure, Cross Site Scripting

SA-CONTRIB-2009-029 - Views Bulk Operations - Access Bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-029
  • Project: Views Bulk Operations (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-May-20
  • Security risk: Medium
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CORE-2009-006 - Drupal core - Cross site scripting

  • Advisory ID: DRUPAL-SA-CORE-2009-006
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-May-13
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-CONTRIB-2009-028 - Feed Block - Cross Site Scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-028
  • Project: Feed Block (third-party module)
  • Version: 6.x
  • Date: 2009-May-13
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-027 - Printer, e-mail and PDF versions - Cross-site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-027
  • Project: Printer, e-mail and PDF versions (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009-May-13
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-026 - LoginToboggan - Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-026
  • Project: LoginToboggan (third-party module)
  • Version: 6.x
  • Date: 2009-May-13
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CORE-2009-005 - Drupal core - Cross site scripting

  • Advisory ID: DRUPAL-SA-CORE-2009-005
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2009-April-29
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-CONTRIB-2009-025 - Fivestar - Cross-site request forgery

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-025
  • Project: Fivestar (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-April-29
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site request forgery

SA-CONTRIB-2009-023 - News Page - SQL injection

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-023
  • Project: News Page
  • Versions: 5.x
  • Date: 2009-April-29
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection

SA-CONTRIB-2009-022 - Exif - Cross Site Scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-022
  • Project: Exif (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-April-29
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting

Description

The Exif module enables users to display EXIF tags in images on the site.

SA-CONTRIB-2009-024 - Node Access User Reference - Access Bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-024
  • Project: Node Access User Reference (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-April-29
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

Description

SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-021
  • Project: CCK comment reference (third-party module)
  • Version: 6.x
  • Date: 2009 April 15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-020 - Print - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-020
  • Project: Printer, e-mail and PDF versions (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-April-15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-019 - Localization client - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-019
  • Project: Localization client (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009-April-15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-018 - Feed element mapper - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-018
  • Project: Feed element mapper (third-party module)
  • Version: 5.x
  • Date: 2009-March-26
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-017 - Vote Up/Down - Cross-site request forgery

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-017
  • Project: Vote Up/Down (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-March-25
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site request forgery

SA-CONTRIB-2009-016 - Wikitools - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-016
  • Project: Wikitools (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-March-25
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting

SA-CONTRIB-2009-015 - Tokenauth - Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-015
  • Project: Token authentication (third-party module)
  • Version: 6.x
  • Date: 2009-March-25
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2009-014 - CCK Field Privacy - Access Bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-014
  • Project: CCK Field Privacy
  • Version: 6.x
  • Date: 2009-March-23
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2009-013 CCK - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-013
  • Project: Content Construction Kit (third-party module)
  • Version: 6.x
  • Date: 2009 March 18
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-012 - Printer, e-mail and PDF versions - Unrestricted e-mailing (spam)

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-012
  • Project: Printer, e-mail and PDF versions (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009 March 18
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Unrestricted e-mailing (spam)

SA-CONTRIB-2009-011 Tasklist - SQL injection and Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-011
  • Project: Tasklist (third-party module)
  • Version: 5.x
  • Date: 2009 March 18
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection and Cross-site scripting (XSS)

SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-010
  • Project: Plus 1 (third-party module)
  • Version: 6.x
  • Date: 2009 March 18
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site request forgery (CSRF)

New pages and RSS feeds for security announcements

Separate Security Announcements by Type

To make the impact of different security advisories and announcements easier to see, they are now separated by type.

Drupal core security advisories: http://drupal.org/security
RSS feed for Drupal core: http://drupal.org/security/rss.xml

Contributed project security advisories: http://drupal.org/security/contrib
RSS feed for contributed projects: http://drupal.org/security/contrib/rss.xml

Public service announcements: http://drupal.org/security/psa
RSS feed for announcements: http://drupal.org/security/psa/rss.xml

We encourage those using RSS readers to track security-related developments to subscribe to all three of these feeds.

All posts to each of these three forums will still be sent to the one security announcements e-mail list. To subscribe to that e-mail list, once logged in, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.

All future public service announcements will only be posted to the Public service announcements page and feed.

SA-CONTRIB-2009-009 Forward module can be used as a spam relay

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-009
  • Project: Forward
  • Versions: 5.x, 6.x
  • Date: 2009-March-11
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Unrestricted e-mailing (spam)

SA-CONTRIB-2009-008 - Taxonomy Theme - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-008
  • Project: Taxonomy Theme (third-party module)
  • Version: 5.x
  • Date: 2009 February 28
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CORE-2009-004 - Local file inclusion on Windows

  • Advisory ID: DRUPAL-SA-CORE-2009-004
  • Project: Drupal core
  • Versions: 5.x
  • Date: 2009-February-25
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Local file inclusion on Windows
  • Reference: SA-CORE-2009-003 (6.x)

SA-CORE-2009-003 - Local file inclusion on Windows

  • Advisory ID: DRUPAL-SA-CORE-2009-003
  • Project: Drupal core
  • Versions: 6.x
  • Date: 2009-February-25
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Local file inclusion on Windows

SA-CONTRIB-2009-007 - Advertisement Cross-site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-007
  • Project: Advertisement module (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009 February 11
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-006 - Troll - Cross site request forgeries

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-006
  • Project: Troll (third-party module)
  • Version: 5.x
  • Date: 2009 February 11
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site request forgeries (CSRF)

Drupal core - Administer content types permission - PSA-2009-001

Date: 
2009-February-11
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Security risk: None

Description

This is a public service announcement regarding the "administer content types" permission. The rise of the Content Construction Kit (CCK) and a legion of powerful CCK field modules have considerably extended the abilities of a user with this permission, with much of a site's behaviour now being configurable via the content types administration pages.

SA-CONTRIB-2009-005 - Views bulk operations - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-005
  • Project: Views bulk operations (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009 February 04
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-004 - Notify - Privilege escalation

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-004
  • Project: Notify
  • Versions: 5.x
  • Date: 2009-January-15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Privilege escalation

SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CORE-2009-001
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Date: 2009-January-14
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

Pages

Subscribe with RSS Subscribe to Security advisories