Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-2008-072 - Storm Project - SQL injection

By killes@www.drop.org on 3 Dec 2008 at 17:50 UTC

Advisory ID: DRUPAL-SA-2008-072
Project: Storm Project
Versions: 5.x and 6.x
Date: 2008-December-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-2008-071 - User Karma - Multiple vulnerabilities

By scor on 26 Nov 2008 at 20:47 UTC

Advisory ID: DRUPAL-SA-2008-071
Project: User Karma
Versions: 5.x and 6.x
Date: 2008-November-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL injection, Cross-site scripting (XSS)

SA-2008-070 - Comment Mail - Cross site request forgery

By scor on 26 Nov 2008 at 18:40 UTC

Advisory ID: DRUPAL-SA-2008-070
Project: Comment Mail
Versions: 5.x
Date: 2008-November-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-2008-069 - CCK for 5.x and 6.x - XSS vulnerabilities

By damien tournoud on 5 Nov 2008 at 18:51 UTC

Advisory ID: DRUPAL-SA-2008-069
Project: Content Construction Kit (third-party module)
Versions: 5.x, 6.x
Date: 2008-November-5
Security risk: Minor
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-068 - Localization client and Localization server - Cross site request forgery

By gábor hojtsy on 22 Oct 2008 at 20:34 UTC

Advisory ID: DRUPAL-SA-2008-068
Project: Localization client and Localization server (third-party modules)
Versions: 5.x, 6.x
Date: 2008-October-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-2008-067 - Drupal core - Multiple vulnerabilities

By gábor hojtsy on 22 Oct 2008 at 19:06 UTC

Advisory ID: DRUPAL-SA-2008-067
Project: Drupal core
Versions: 5.x and 6.x
Date: 2008-October-22
Security risk: Less Critical
Exploitable from: Local/Remote
Vulnerability: Multiple vulnerabilities

SA-2008-066 - Shindig-Integrator - Multiple vulnerabilities

By heine on 15 Oct 2008 at 19:02 UTC

Advisory ID: DRUPAL-SA-2008-066
Project: Shindig-Integrator (third-party module)
Versions: 5.x
Date: 2008-October-15
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-065 - Node Clone - Access bypass

By pwolanin on 15 Oct 2008 at 18:27 UTC

Advisory ID: DRUPAL-SA-2008-065
Project: Node Clone (third-party module)
Version: 6.x, and 5.x.
Date: 2008-October-15
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-064 - Node Vote - SQL injection vulnerability

By kbahey on 15 Oct 2008 at 16:46 UTC

Advisory ID: DRUPAL-SA-2008-064
Project: Node Vote (third-party module)
Versions: 5.x and 6.x
Date: 2008-October-15
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-2008-063 - multiple third party modules - Access bypass due to incorrect Drupal 6 updates

By pwolanin on 9 Oct 2008 at 19:41 UTC

Advisory ID: DRUPAL-SA-2008-063
Project: Several Third-Party Modules incorrectly updated for the Drupal 6 menu system
Version: 6.x
Date: 2008-October-8
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-062 - SIOC - access bypass

By Amazon on 8 Oct 2008 at 21:47 UTC

Advisory ID: DRUPAL-SA-2008-062
Project: SIOC (third-party module)
Versions: 5.x and 6.x
Date: 2008-October-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-061 - Everyblog - Multiple vulnerabilities

By Amazon on 8 Oct 2008 at 21:45 UTC

Advisory ID: DRUPAL-SA-2008-061
Project: EveryBlog (third-party module)
Versions: 5.x and 6.x
Date: 2008-October-08
Security risk: Highly critical
Exploitable from: Remote
Vulnerability:SQL injection, Cross-site scripting (XSS), Privilege escalation, access bypass

SA-2008-060 - Drupal core - Multiple vulnerabilities

By gábor hojtsy on 8 Oct 2008 at 21:43 UTC

Advisory ID: DRUPAL-SA-2008-060
Project: Drupal core
Versions: 5.x and 6.x
Date: 2008-October-8
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-059 - Brilliant Gallery - SQL Injection and Cross Site Scripting

By kbahey on 1 Oct 2008 at 20:24 UTC

Advisory ID: DRUPAL-SA-2008-059
Project: Brilliant Gallery (third-party module)
Versions: 5.x
Date: 2008-October-1
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection and Cross Site Scripting

SA-2008-058 - Brilliant Gallery - SQL Injection

By heine on 24 Sep 2008 at 22:42 UTC

Advisory ID: DRUPAL-SA-2008-058
Project: Brilliant Gallery (third-party module)
Versions: 5.x, 6.x
Date: 2008-September-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-2008-057 - Ajax Checklist - Multiple vulnerabilities

By heine on 24 Sep 2008 at 19:48 UTC

Advisory ID: DRUPAL-SA-2008-057
Project: Ajax Checklist (third-party module)
Versions: 5.x
Date: 2008-September-24
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection, Cross site scripting

SA-2008-056 - Simplenews - Cross site scripting

By heine on 24 Sep 2008 at 18:58 UTC

Advisory ID: DRUPAL-SA-2008-056
Project: Simplenews (third-party module)
Versions: 5.x, 6.x
Date: 2008-September-24
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-055 - Stock - Cross site scripting

By heine on 24 Sep 2008 at 18:13 UTC

Advisory ID: DRUPAL-SA-2008-055
Project: Stock (third-party module)
Versions: 6.x
Date: 2008-September-24
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-054 - Plugin Manager - Access bypass

By heine on 24 Sep 2008 at 16:54 UTC

Advisory ID: DRUPAL-SA-2008-054
Project: Plugin Manager (third-party module)
Versions: 6.x
Date: 2008-September-24
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-053 - Answers - Cross site scripting

By heine on 18 Sep 2008 at 13:31 UTC

Advisory ID: DRUPAL-SA-2008-053
Project: Answers (third-party module)
Versions: 5.x
Date: 2008-September-18
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-052 - Link To Us - Cross site scripting

By heine on 17 Sep 2008 at 19:13 UTC

Advisory ID: DRUPAL-SA-2008-052
Project: Link To Us (third-party module)
Versions: 5.x
Date: 2008-September-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-051 - Mailsave - Cross site scripting

By heine on 17 Sep 2008 at 17:20 UTC

Advisory ID: DRUPAL-SA-2008-051
Project: Mailsave (third-party module)
Versions: 5.x and 6.x
Date: 2008-September-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-050 - Mailhandler - SQL injection

By heine on 17 Sep 2008 at 16:31 UTC

Advisory ID: DRUPAL-SA-2008-050
Project: Mailhandler (third-party module)
Versions: 5.x and 6.x
Date: 2008-September-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-2008-049 - Talk - Multiple vulnerabilities

By heine on 17 Sep 2008 at 16:11 UTC

Advisory ID: DRUPAL-SA-2008-049
Project: Talk (third-party module)
Version: 5.x, 6.x
Date: 2008-September-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Node access bypass

SA-2008-048-b - CCK - Cross site scripting

By heine on 4 Sep 2008 at 19:43 UTC

Advisory ID: DRUPAL-SA-2008-048-b
Project: CCK (third-party module)
Version: 5.x
Date: 2008-Sep-04
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-047 - Drupal core - Multiple vulnerabilities

By heine on 13 Aug 2008 at 23:27 UTC

Advisory ID: DRUPAL-SA-2008-047
Project: Drupal core
Version: 5.x, 6.x
Date: 2008-August-13
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-046 - Drupal core - Session fixation

By heine on 23 Jul 2008 at 19:58 UTC

Advisory ID: DRUPAL-SA-2008-046
Project: Drupal core
Version: 5.x
Date: 2008-July-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Session fixation

SA-2008-045 - OpenID - Multiple vulnerabilities

By heine on 9 Jul 2008 at 22:08 UTC

Advisory ID: DRUPAL-SA-2008-045
Project: OpenID (third-party module)
Version: 5.x
Date: 2008-July-9
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Cross site request forgeries

SA-2008-044 - Drupal core - Multiple vulnerabilities

By heine on 9 Jul 2008 at 21:24 UTC

Advisory ID: DRUPAL-SA-2008-044
Project: Drupal core
Version: 5x, 6.x
Date: 2008-July-9
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-043 - Outline designer - Privilege escalation

By heine on 2 Jul 2008 at 20:56 UTC

Advisory ID: DRUPAL-SA-2008-043
Project: Outline designer (third-party module)
Version: 5.x
Date: 2008-July-2
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Privilege escalation

SA-2008-042 - Tinytax - Cross site scripting

By heine on 2 Jul 2008 at 20:51 UTC

Advisory ID: DRUPAL-SA-2008-042
Project: Tinytax taxonomy block (third-party module)
Version: 5.x
Date: 2008-July-2
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-041 - Taxonomy autotagger - Multiple vulnerabilities

By heine on 2 Jul 2008 at 20:48 UTC

Advisory ID: DRUPAL-SA-2008-041
Project: Taxonomy autotagger (third-party module)
Version: 5.x
Date: 2008-July-2
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting and SQL injection

SA-2008-040 - Organic Groups - Cross site scripting and information disclosure

By moshe weitzman on 2 Jul 2008 at 20:42 UTC

Advisory ID: DRUPAL-SA-2008-040
Project: Organic Groups (third-party module)
Versions: 5.x and 6.x
Date: 2008-July-02
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross site scripting and information disclosure

SA-2008-039 - Suggested terms - Cross site scripting

By heine on 25 Jun 2008 at 18:53 UTC

Advisory ID: SA-2008-039
Project: Suggested terms (third-party module)
Versions: 5.x
Date: 2008-June-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-038 - Services - Arbitrary code execution

By heine on 18 Jun 2008 at 21:50 UTC

Advisory ID: DRUPAL-SA-2008-038
Project: Services (third-party module)
Versions: 5.x and 6.x
Date: 2008-June-18
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-2008-037 - TrailScout - XSS and SQL injection

By killes@www.drop.org on 18 Jun 2008 at 21:07 UTC

Advisory ID: DRUPAL-SA-2008-037
Project: TrailScout (third-party module)
Version: 5.x
Date: 2008-June-18
Security risk: Higly critical
Exploitable from: Remote
Vulnerability: Cross site scripting and SQL injection

SA-2008-036 - Profile search - SQL Injection

By heine on 18 Jun 2008 at 15:15 UTC

Advisory ID: SA-2008-036
Project: Profile Search (third-party module)
Versions: 5.x
Date: 2008-July-18
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-035 - Aggregation - Multiple vulnerabilities

By heine on 11 Jun 2008 at 19:44 UTC

Advisory ID: SA-2008-035
Project: Aggregation (third-party module)
Versions: 5.x
Date: 2008-June-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-034 - Node Hierarchy - Access bypass

By heine on 11 Jun 2008 at 19:24 UTC

Advisory ID: SA-2008-034
Project: Node Hierarchy (third-party module)
Versions: 5.x and 6.x
Date: 2008-June-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-033 - Taxonomy Image - Cross site scripting

By heine on 11 Jun 2008 at 16:11 UTC

Advisory ID: SA-2008-033
Project: Taxonomy Image (third-party module)
Versions: 5.x and 6.x
Date: 2008-June-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-032 - Magic Tabs - Arbitrary code execution

By heine on 11 Jun 2008 at 13:16 UTC

Advisory ID: SA-2008-032
Project: Magic Tabs (third-party module)
Versions: 5.x
Date: 2008-June-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-2008-031 - Pblog - Incorrect vulnerability report

By heine on 11 Jun 2008 at 12:31 UTC

Advisory ID: SA-2008-031
Project: Pblog (third-party module)
Versions: none
Date: 2008-June-11
Security risk: Not critical
Exploitable from: Remote
Subject: Incorrect vulnerability report

SA-2008-030 - Site Documentation - Privilege escalation

By heine on 14 May 2008 at 19:02 UTC

Advisory ID: DRUPAL-SA-2008-030
Project: Site Documentation (third-party module)
Versions: 5.x and 6.x
Date: 2008-May-14
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Privilege escalation

SA-2008-029 - E-Publish - Cross site scripting and Cross site request forgeries

By heine on 23 Apr 2008 at 20:34 UTC

Advisory ID: DRUPAL-SA-2008-029
Project: E-Publish (third-party module)
Versions: 5.x and 6.x
Date: 2008-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting and Cross site request forgeries

SA-2008-028 - Internationalization and Localizer - Cross site scripting

By heine on 23 Apr 2008 at 18:16 UTC

Advisory ID: DRUPAL-SA-2008-028
Project: Internationalization and Localizer (third-party modules)
Versions: 5.x and 6.x
Date: 2008-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-027 - Ubercart - Cross site scripting

By heine on 23 Apr 2008 at 18:16 UTC

Advisory ID: DRUPAL-SA-2008-027
Project: Ubercart (third-party module)
Version: 5.x
Date: 2008-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-026 - Drupal core - Access bypass

By heine on 9 Apr 2008 at 20:25 UTC

Advisory ID: DRUPAL-SA-2008-026
Project: Drupal core
Version: 6.x
Date: 2008-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-025 - Simple access - Access bypass

By dww on 9 Apr 2008 at 17:42 UTC

Advisory ID: DRUPAL-SA-2008-025
Project: Simple access (third-party module)
Version: 5.x-1.*
Date: 2008-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-024 - Webform - Cross site scripting

By heine on 3 Apr 2008 at 03:57 UTC

Advisory ID: DRUPAL-SA-2008-024
Project: Webform (third-party module)
Version: 5.x, 6.x
Date: 2008-April-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-023 - Ubercart - Cross site scripting

By heine on 2 Apr 2008 at 20:13 UTC

Advisory ID: DRUPAL-SA-2008-023
Project: Ubercart (third-party module)
Version: 5.x
Date: 2008-April-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

Pages

Subscribe with RSS