SA-CONTRIB-2009-016 - Wikitools - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-016
  • Project: Wikitools (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-March-25
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting

SA-CONTRIB-2009-015 - Tokenauth - Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-015
  • Project: Token authentication (third-party module)
  • Version: 6.x
  • Date: 2009-March-25
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2009-014 - CCK Field Privacy - Access Bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-014
  • Project: CCK Field Privacy
  • Version: 6.x
  • Date: 2009-March-23
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2009-013 CCK - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-013
  • Project: Content Construction Kit (third-party module)
  • Version: 6.x
  • Date: 2009 March 18
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-012 - Printer, e-mail and PDF versions - Unrestricted e-mailing (spam)

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-012
  • Project: Printer, e-mail and PDF versions (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009 March 18
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Unrestricted e-mailing (spam)

SA-CONTRIB-2009-011 Tasklist - SQL injection and Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-011
  • Project: Tasklist (third-party module)
  • Version: 5.x
  • Date: 2009 March 18
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection and Cross-site scripting (XSS)

SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-010
  • Project: Plus 1 (third-party module)
  • Version: 6.x
  • Date: 2009 March 18
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site request forgery (CSRF)

New pages and RSS feeds for security announcements

Separate Security Announcements by Type

To make the impact of different security advisories and announcements easier to see, they are now separated by type.

Drupal core security advisories: http://drupal.org/security
RSS feed for Drupal core: http://drupal.org/security/rss.xml

Contributed project security advisories: http://drupal.org/security/contrib
RSS feed for contributed projects: http://drupal.org/security/contrib/rss.xml

Public service announcements: http://drupal.org/security/psa
RSS feed for announcements: http://drupal.org/security/psa/rss.xml

We encourage those using RSS readers to track security-related developments to subscribe to all three of these feeds.

All posts to each of these three forums will still be sent to the one security announcements e-mail list. To subscribe to that e-mail list, once logged in, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.

All future public service announcements will only be posted to the Public service announcements page and feed.

SA-CONTRIB-2009-009 Forward module can be used as a spam relay

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-009
  • Project: Forward
  • Versions: 5.x, 6.x
  • Date: 2009-March-11
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Unrestricted e-mailing (spam)

SA-CONTRIB-2009-008 - Taxonomy Theme - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-008
  • Project: Taxonomy Theme (third-party module)
  • Version: 5.x
  • Date: 2009 February 28
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CORE-2009-004 - Local file inclusion on Windows

  • Advisory ID: DRUPAL-SA-CORE-2009-004
  • Project: Drupal core
  • Versions: 5.x
  • Date: 2009-February-25
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Local file inclusion on Windows
  • Reference: SA-CORE-2009-003 (6.x)

SA-CORE-2009-003 - Local file inclusion on Windows

  • Advisory ID: DRUPAL-SA-CORE-2009-003
  • Project: Drupal core
  • Versions: 6.x
  • Date: 2009-February-25
  • Security risk: Highly Critical
  • Exploitable from: Remote
  • Vulnerability: Local file inclusion on Windows

SA-CONTRIB-2009-007 - Advertisement Cross-site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-007
  • Project: Advertisement module (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2009 February 11
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-006 - Troll - Cross site request forgeries

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-006
  • Project: Troll (third-party module)
  • Version: 5.x
  • Date: 2009 February 11
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site request forgeries (CSRF)

Drupal core - Administer content types permission - PSA-2009-001

Date: 
2009-February-11
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Security risk: None

Description

This is a public service announcement regarding the "administer content types" permission. The rise of the Content Construction Kit (CCK) and a legion of powerful CCK field modules have considerably extended the abilities of a user with this permission, with much of a site's behaviour now being configurable via the content types administration pages.

SA-CONTRIB-2009-005 - Views bulk operations - Cross site scripting

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-005
  • Project: Views bulk operations (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009 February 04
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-004 - Notify - Privilege escalation

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-004
  • Project: Notify
  • Versions: 5.x
  • Date: 2009-January-15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Privilege escalation

SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CORE-2009-001
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Date: 2009-January-14
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-003 - Internationalizaion (i18n) Translation module - Access bypass

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-003
  • Project: Internationalization (i18n) (third-party module)
  • Version: 5.x-2.x
  • Date: 2009-January-14
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-CONTRIB-2009-002 - Project issue tracking - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-002
  • Project: Project issue tracking (third-party module)
  • Version: 5.x-2.x
  • Date: 2009-January-07
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Node access bypass, Cross-site scripting (XSS)

SA-CONTRIB-2009-001 - Project release - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-CONTRIB-2009-001
  • Project: Project release (third-party module)
  • Version: 5.x
  • Date: 2009-January-07
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerabilities: Arbitrary file upload, Cross-site scripting (XSS)

SA-2008-075 - Views - SQL Injection

  • Advisory ID: DRUPAL-SA-2008-075
  • Project: Views
  • Versions: 6.x
  • Date: 2008-December-16
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection

SA-2008-074 - Services - Insecure signing

  • Advisory ID: DRUPAL-SA-2008-074
  • Project: Services (third-party module)
  • Versions: 5.x and 6.x
  • Date: 2008-December-17
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Repeat attacks and impersonation

SA-2008-073 - Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-073
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Date: 2008-December-10
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-2008-072 - Storm Project - SQL injection

  • Advisory ID: DRUPAL-SA-2008-072
  • Project: Storm Project
  • Versions: 5.x and 6.x
  • Date: 2008-December-03
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection

SA-2008-071 - User Karma - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-071
  • Project: User Karma
  • Versions: 5.x and 6.x
  • Date: 2008-November-26
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection, Cross-site scripting (XSS)

SA-2008-070 - Comment Mail - Cross site request forgery

  • Advisory ID: DRUPAL-SA-2008-070
  • Project: Comment Mail
  • Versions: 5.x
  • Date: 2008-November-26
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site request forgery

SA-2008-069 - CCK for 5.x and 6.x - XSS vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-069
  • Project: Content Construction Kit (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2008-November-5
  • Security risk: Minor
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-068 - Localization client and Localization server - Cross site request forgery

  • Advisory ID: DRUPAL-SA-2008-068
  • Project: Localization client and Localization server (third-party modules)
  • Versions: 5.x, 6.x
  • Date: 2008-October-22
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site request forgery

SA-2008-067 - Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-067
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Date: 2008-October-22
  • Security risk: Less Critical
  • Exploitable from: Local/Remote
  • Vulnerability: Multiple vulnerabilities

SA-2008-066 - Shindig-Integrator - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-066
  • Project: Shindig-Integrator (third-party module)
  • Versions: 5.x
  • Date: 2008-October-15
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-2008-065 - Node Clone - Access bypass

  • Advisory ID: DRUPAL-SA-2008-065
  • Project: Node Clone (third-party module)
  • Version: 6.x, and 5.x.
  • Date: 2008-October-15
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-2008-064 - Node Vote - SQL injection vulnerability

  • Advisory ID: DRUPAL-SA-2008-064
  • Project: Node Vote (third-party module)
  • Versions: 5.x and 6.x
  • Date: 2008-October-15
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection

SA-2008-063 - multiple third party modules - Access bypass due to incorrect Drupal 6 updates

  • Advisory ID: DRUPAL-SA-2008-063
  • Project: Several Third-Party Modules incorrectly updated for the Drupal 6 menu system
  • Version: 6.x
  • Date: 2008-October-8
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-2008-062 - SIOC - access bypass

  • Advisory ID: DRUPAL-SA-2008-062
  • Project: SIOC (third-party module)
  • Versions: 5.x and 6.x
  • Date: 2008-October-08
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-2008-061 - Everyblog - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-061
  • Project: EveryBlog (third-party module)
  • Versions: 5.x and 6.x
  • Date: 2008-October-08
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability:SQL injection, Cross-site scripting (XSS), Privilege escalation, access bypass

SA-2008-060 - Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-060
  • Project: Drupal core
  • Versions: 5.x and 6.x
  • Date: 2008-October-8
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

SA-2008-059 - Brilliant Gallery - SQL Injection and Cross Site Scripting

  • Advisory ID: DRUPAL-SA-2008-059
  • Project: Brilliant Gallery (third-party module)
  • Versions: 5.x
  • Date: 2008-October-1
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection and Cross Site Scripting

SA-2008-058 - Brilliant Gallery - SQL Injection

  • Advisory ID: DRUPAL-SA-2008-058
  • Project: Brilliant Gallery (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2008-September-25
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection

SA-2008-057 - Ajax Checklist - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-057
  • Project: Ajax Checklist (third-party module)
  • Versions: 5.x
  • Date: 2008-September-24
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection, Cross site scripting

SA-2008-056 - Simplenews - Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-056
  • Project: Simplenews (third-party module)
  • Versions: 5.x, 6.x
  • Date: 2008-September-24
  • Security risk: Not Critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-055 - Stock - Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-055
  • Project: Stock (third-party module)
  • Versions: 6.x
  • Date: 2008-September-24
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-054 - Plugin Manager - Access bypass

  • Advisory ID: DRUPAL-SA-2008-054
  • Project: Plugin Manager (third-party module)
  • Versions: 6.x
  • Date: 2008-September-24
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

SA-2008-053 - Answers - Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-053
  • Project: Answers (third-party module)
  • Versions: 5.x
  • Date: 2008-September-18
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-052 - Link To Us - Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-052
  • Project: Link To Us (third-party module)
  • Versions: 5.x
  • Date: 2008-September-17
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-051 - Mailsave - Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-051
  • Project: Mailsave (third-party module)
  • Versions: 5.x and 6.x
  • Date: 2008-September-17
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-050 - Mailhandler - SQL injection

  • Advisory ID: DRUPAL-SA-2008-050
  • Project: Mailhandler (third-party module)
  • Versions: 5.x and 6.x
  • Date: 2008-September-17
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: SQL injection

SA-2008-049 - Talk - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-049
  • Project: Talk (third-party module)
  • Version: 5.x, 6.x
  • Date: 2008-September-17
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting, Node access bypass

SA-2008-048-b - CCK - Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-048-b
  • Project: CCK (third-party module)
  • Version: 5.x
  • Date: 2008-Sep-04
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross site scripting

SA-2008-047 - Drupal core - Multiple vulnerabilities

  • Advisory ID: DRUPAL-SA-2008-047
  • Project: Drupal core
  • Version: 5.x, 6.x
  • Date: 2008-August-13
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

Pages

Subscribe with RSS Subscribe to Security advisories