Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2014-006 - Language Switcher Dropdown - Open Redirect

By Drupal Security Team on 22 Jan 2014 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-006
Project: Language Switcher Dropdown (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Open Redirect

SA-CONTRIB-2014-005 - Leaflet - Access bypass

By Drupal Security Team on 22 Jan 2014 at 15:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-005
Project: Leaflet (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2014-004 - Secure Cookie Data - Faulty Hashing

By Drupal Security Team on 22 Jan 2014 at 15:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-004
Project: Secure Cookie Data (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure, Multiple vulnerabilities

SA-CONTRIB-2014-003 - Doubleclick for Publishers DFP - Cross Site Scripting (XSS)

By Drupal Security Team on 22 Jan 2014 at 14:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-003
Project: Doubleclick for Publishers (DFP) (third-party module)
Version: 7.x
Date: 2014-January-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2014-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 15 Jan 2014 at 19:33 UTC

Advisory ID: DRUPAL-SA-CORE-2014-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2014-January-15
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)

By Drupal Security Team on 14 Jan 2014 at 15:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-002
Project: Anonymous Posting (third-party module)
Version: 7.x
Date: 2014-January-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Media - Access Bypass - PSA-2014-001

Date:

2014-January-08

Advisory ID: PSA-2014-001
Project: Media (third-party module)
Version: 7.x
Date: 2014-01-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2014-001 - Entity API - Access Bypass

By Drupal Security Team on 8 Jan 2014 at 17:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2014-001
Project: Entity API (third-party module)
Version: 7.x
Date: 2014-January-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-098 - Ubercart - Session Fixation Vulnerability

By Drupal Security Team on 17 Dec 2013 at 20:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-098
Project: Ubercart (third-party module)
Version: 6.x, 7.x
Date: 2013-12-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Session Fixation

SA-CONTRIB-2013-097 - OG Features - Access bypass

By Drupal Security Team on 4 Dec 2013 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-097
Project: OG Features (third-party module)
Version: 6.x
Date: 2013-December-04
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 20 Nov 2013 at 20:41 UTC

Advisory ID: DRUPAL-SA-CORE-2013-003
Project: Drupal core
Version: 6.x, 7.x
Date: 2013-November-20
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2013-096 - Entity reference - Access bypass

By Drupal Security Team on 20 Nov 2013 at 18:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-096
Project: Entity reference (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-095 - Organic Groups - Access bypass

By Drupal Security Team on 20 Nov 2013 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-095
Project: Organic groups (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-094 - EU Cookie Compliance - Cross Site Scripting (XSS)

By Drupal Security Team on 20 Nov 2013 at 16:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-094
Project: EU Cookie Compliance (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-093 - Invitation - Access Bypass

By Drupal Security Team on 20 Nov 2013 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-093
Project: Invitation (third-party module)
Version: 7.x
Date: 2013-November-20
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-092 - Misery - Denial of Service (DOS) vulnerability.

By Drupal Security Team on 13 Nov 2013 at 19:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-092
Project: Misery (third-party module)
Version: 6.x, 7.x
Date: 2013-November-13
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2013-091 - Groups, Communities and Co (GCC) - Access Bypass

By Drupal Security Team on 13 Nov 2013 at 19:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-091
Project: Groups, Communities and Co (GCC) (third-party module)
Version: 7.x
Date: 2013-November-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-090 - Revisioning - Access Bypass

By Drupal Security Team on 13 Nov 2013 at 19:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-090
Project: Revisioning (third-party module)
Version: 7.x
Date: 2013-November-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-089 - Node Access Keys - Access Bypass

By Drupal Security Team on 6 Nov 2013 at 19:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-089
Project: Node Access Keys (third-party module)
Version: 7.x
Date: 2013-November-06
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-088 - Secure Pages - Missing Encryption of Sensitive Data

By Drupal Security Team on 6 Nov 2013 at 19:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-088
Project: Secure Pages (third-party module)
Version: 6.x
Date: 2013-November-06
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Missing Encryption of Sensitive Data

SA-CONTRIB-2013-087 - Payment for Webform - Access Bypass

By Drupal Security Team on 6 Nov 2013 at 19:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-087
Project: Payment for Webform (third-party module)
Version: 7.x
Date: 2013-November-06
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

Direct download links available even during Drupal.org upgrade window - PSA-2013-002

Date:

2013-October-30

This is a short addition to the security announcements released on October 30th.

Due to Drupal.org's scheduled downtime on October 31, not all links in those mails may be available when you need them.

If you encounter this situation, please use the following direct URLs to the archives containing the updates.

SA-CONTRIB-2013-086 - Monster Menus - Access bypass

By Drupal Security Team on 30 Oct 2013 at 18:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-086
Project: Monster Menus (third-party module)
Version: 7.x
Date: 2013-October-30
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-085 - Feed Element Mapper - Cross Site Scripting

By Drupal Security Team on 30 Oct 2013 at 18:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-085
Project: Feed Element Mapper (third-party module)
Version: 6.x
Date: 2013-October-30
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-084 - FileField Sources - Access Bypass

By Drupal Security Team on 30 Oct 2013 at 18:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-084
Project: FileField Sources (third-party module)
Version: 6.x, 7.x
Date: 2013-October-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-083 - Quiz - Access Bypass

By Drupal Security Team on 30 Oct 2013 at 14:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-083
Project: Quiz (third-party module)
Version: 6.x
Date: 2013-October-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities

SA-CONTRIB-2013-082 - Bean - Cross Site Scripting (XSS)

By Drupal Security Team on 23 Oct 2013 at 18:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-082
Project: Bean (third-party module)
Version: 7.x
Date: 2013-10-23
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-081 - Spaces - Access bypass

By Drupal Security Team on 23 Oct 2013 at 16:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-081
Project: Spaces (third-party module)
Version: 6.x
Date: 2013-10-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-080 - Simplenews - Cross Site Scripting (XSS)

By Drupal Security Team on 16 Oct 2013 at 18:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-080
Project: Simplenews (third-party module)
Version: 6.x, 7.x
Date: 2013-Month-DD
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-079 - Context - Multiple Vulnerabilities

By Drupal Security Team on 16 Oct 2013 at 15:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-079
Project: Context (third-party module)
Version: 6.x, 7.x
Date: 2013-2013-16
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass, Arbitrary PHP code execution

SA-CONTRIB-2013-078 - Quick Tabs - Access Bypass

By Drupal Security Team on 2 Oct 2013 at 17:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-078
Project: Quick Tabs (third-party module)
Version: 6.x, 7.x
Date: 2013-October-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-077 - Google Site Search - Cross Site Scripting (XSS)

By Drupal Security Team on 18 Sep 2013 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-077
Project: Google Site Search (third-party module)
Version: 6.x, 7.x
Date: 2013-September-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-076 - jQuery Countdown - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Sep 2013 at 21:15 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-076
Project: jQuery Countdown (third-party module)
Version: 7.x
Date: 2013-September-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-075 - Click2Sell - Multiple Vulnerabilities (XSS and CSRF)

By Drupal Security Team on 11 Sep 2013 at 20:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-075
Project: Click2Sell Suite (third-party module)
Version: 6.x
Date: 2013-September-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2013-074 - MediaFront - Cross Site Scripting (XSS)

By Drupal Security Team on 11 Sep 2013 at 20:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-074
Project: MediaFront (third-party module)
Version: 6.x, 7.x
Date: 2013-September-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Drupal core - Users can insert hidden text and links - PSA-2013-001

Date:

2013-September-04

Advisory ID: PSA-2013-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2013-September-04
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2013-073 - Make Meeting Scheduler - Access Bypass

By Drupal Security Team on 4 Sep 2013 at 14:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-073
Project: Make Meeting Scheduler (third-party module)
Version: 6.x
Date: 2013-September-04
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-072 - Node View Permissions - Access Bypass

By Drupal Security Team on 28 Aug 2013 at 18:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-072
Project: Node View Permissions (third-party module)
Version: 7.x
Date: 2013-August-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-071 - Flag - Cross Site Scripting

By Drupal Security Team on 28 Aug 2013 at 17:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-071
Project: Flag (third-party module)
Version: 7.x
Date: 2013-August-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-070 - Zen - Cross Site Scripting

By Drupal Security Team on 21 Aug 2013 at 19:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-070
Project: Zen (third-party module)
Version: 7.x
Date: 2013-August-21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-069 - Password Policy - XSS

By Drupal Security Team on 14 Aug 2013 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-069
Project: Password policy (third-party module)
Version: 6.x, 7.x
Date: 2013-August-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2013-068 - Entity API - Access Bypass

By Drupal Security Team on 14 Aug 2013 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-068
Project: Entity API (third-party module)
Version: 7.x
Date: 2013-August-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-067 - BOTCHA - Information Disclosure (potential Privilege Escalation)

By Drupal Security Team on 14 Aug 2013 at 13:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-067
Project: BOTCHA Spam Prevention (third-party module)
Version: 7.x
Date: 2013-August-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2013-066 - Monster Menus - Multiple Vulnerabilities

By Drupal Security Team on 7 Aug 2013 at 19:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-066
Project: Monster Menus (third-party module)
Version: 6.x, 7.x
Date: 2013-August-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-065 - Organic Groups - Access Bypass

By Drupal Security Team on 7 Aug 2013 at 18:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-065
Project: Organic groups (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass, Multiple vulnerabilities

SA-CONTRIB-2013-064 - Persona - Cross site request forgery (CSRF)

By Drupal Security Team on 7 Aug 2013 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-064
Project: Mozilla Persona (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2013-063 - Authenticated User Page Caching (Authcache) - Information Disclosure

By Drupal Security Team on 7 Aug 2013 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-063
Project: Authenticated User Page Caching (Authcache) (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2013-062 - RESTful Web Services (RESTWS) - Access Bypass

By Drupal Security Team on 7 Aug 2013 at 15:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-062
Project: RESTful Web Services (third-party module)
Version: 7.x
Date: 2013-August-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-061 - Flippy - Access Bypass

By Drupal Security Team on 31 Jul 2013 at 15:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-061
Project: Flippy (third-party module)
Version: 7.x
Date: 2013-July-31
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2013-060 - Scald - Cross Site Scripting (XSS)

By Drupal Security Team on 24 Jul 2013 at 15:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2013-060
Project: Scald (third-party module)
Version: 6.x, 7.x
Date: 2013-July-24
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS