Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2010-069 - Case Tracker - Multiple Vulnerabilities

By Drupal Security Team on 23 Jun 2010 at 18:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-069
Project: Case Tracker (third-party module)
Version: 5.x
Date: 2010-June-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple Vulnerabilities

SA-CONTRIB-2010-068 - Masquerade - Cross Site Request Forgery

By Drupal Security Team on 23 Jun 2010 at 17:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-068
Project: Masquerade (third-party module)
Version: 5.x, 6.x
Date: 2010-June-23
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2010-067 - Views - Multiple vulnerabilities

By Drupal Security Team on 17 Jun 2010 at 02:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-067
Project: Views (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-066 - FileField - Cross Site Scripting

By Drupal Security Team on 17 Jun 2010 at 01:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-066
Project: FileField (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Views - Administer views permission - PSA-2010-002

Date:

2010-June-16

Advisory ID: PSA-2010-002
Project: Views (third-party module)
Versions: 5.x, 6.x
Date: 2010-June-16
Security risk: Not critical

SA-CONTRIB-2010-065 - Content Construction Kit (CCK) - Access Bypass

By Drupal Security Team on 16 Jun 2010 at 20:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-065
Project: Content Construction Kit (CCK) (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-064 - Ubercart MIGS Payment Gateway - Web Parameter Tampering

By Drupal Security Team on 16 Jun 2010 at 19:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-064
Project: Ubercart MIGS Payment Gateway (third-party module)
Versions: 6.x
Date: 2010-Jun-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Web Parameter Tampering

SA-CONTRIB-2010-063 - Studio theme pack - Cross Site Scripting

By Drupal Security Team on 16 Jun 2010 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-063
Project: Studio theme pack (third-party theme)
Version: 6.x
Date: 2010-June-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-062 - Ogone | Ubercart payment - Access Bypass

By Drupal Security Team on 16 Jun 2010 at 18:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-062
Project: Ogone | Ubercart payment (third-party module)
Version: 5.x, 6.x
Date: 2010-June-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-061 - AddonChat - Multiple Vulnerabilities

By Drupal Security Team on 26 May 2010 at 20:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-061
Project: AddonChat (third-party module)
Version: 6.x-1.x
Date: 2010-May-26
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Multiple (Privilege Escalation, Cross-site scripting)

SA-CONTRIB-2010-060 - Scheduler - Cross Site Scripting

By Drupal Security Team on 26 May 2010 at 19:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-060
Project: Scheduler (third-party module)
Version: 5.x, 6.x
Date: 2010-May-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-059: Panels - Arbitrary PHP code execution

By Drupal Security Team on 20 May 2010 at 02:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-059
Project: Panels (third-party module)
Versions: 6.x
Date: 2010 May 19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary PHP code execution

SA-CONTRIB-2010-058: Chaos tool suite - Multiple vulnerabilities

By Drupal Security Team on 20 May 2010 at 02:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-058
Project: Chaos tool suite (third-party module)
Versions: 6.x
Date: 2010 May 19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-057 - Rotor Banner - Cross Site Scripting (XSS)

By Drupal Security Team on 20 May 2010 at 02:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-057
Project: Rotor Banner (third-party module)
Versions: 6.x-2.x, 5.x-1.x
Date: 2010-May-19
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-056 - User Queue - Cross Site Request Forgery

By Drupal Security Team on 19 May 2010 at 23:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-056
Project: User Queue (third-party module)
Versions: 6.x
Date: 2010-May-19
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-055 - Simplenews - Access bypass

By Drupal Security Team on 19 May 2010 at 22:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-055
Project: Simplenews (third-party module)
Version: 6.x
Date: 2010-May-19
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2010-054 - Storm - Cross Site Scripting (XSS)

By Drupal Security Team on 19 May 2010 at 22:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-054
Project: Storm (third-party module)
Version: 6.x
Date: 2010-May-19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS)

SA-CONTRIB-2010-053 - External Link Page - Cross Site Scripting (XSS)

By Drupal Security Team on 19 May 2010 at 22:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-053
Project: External Link Page (third-party module)
Version: 5.x, 6.x
Date: 2010-May-19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-052 - Multiple vulnerabilities in multiple contributed modules

By Drupal Security Team on 19 May 2010 at 21:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-052
Projects: Multiple third party modules - Privatemsg, Weather Underground, Tellafriend, Menu Block Split, osCommerce, Download Count, Comment Page, False Account Detector, User Queue
Version: 5.x, 6.x
Date: 2010-05-19
Security risks: Critical
Exploitable from: Remote
Vulnerability: Multiple (Cross-site Request Forgery, Cross-site scripting, Email header injection, SQL Injection)

SA-CONTRIB-2010-051 - Heartbeat - Cross Site Scripting

By Drupal Security Team on 19 May 2010 at 19:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-051
Project: Heartbeat (third-party module)
Version: 6.x
Date: 2010-May-19
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-050 - CAPTCHA - Cross Site Scripting

By Drupal Security Team on 19 May 2010 at 19:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-050
Project: CAPTCHA (third-party module)
Version: 5.x, 6.x
Date: 2010-May-19
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-049 - Wordpress Import - Access bypass

By Drupal Security Team on 19 May 2010 at 17:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-049
Project: Wordpress Import (third-party module)
Version: 6.x
Date: 2010-May-19
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Access bypass

Policy on release versions and permissions - PSA-2010-001

Date:

2010-May-13

Advisory ID: PSA-2010-001
Project: Drupal core and contrib
Versions: 5.x and 6.x and above
Date: 2010-May-13
Security risk: None

SA-CONTRIB-2010-048: CiviRegister - Cross Site Scripting

By Drupal Security Team on 12 May 2010 at 20:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-048
Project: CiviRegister (third-party module)
Version: 5.x, 6.x
Date: 2010-May-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-047: Services - Access Bypass

By Drupal Security Team on 12 May 2010 at 19:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-047
Project: Services (third-party module)
Version: 6.x
Date: 2010-May-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-046: Award - Cross Site Scripting

By Drupal Security Team on 12 May 2010 at 18:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-046
Project: Award (third-party module)
Version: 5.x, 6.x
Date: 2010-May-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-045 - Auto Assign Role - Access bypass

By Drupal Security Team on 12 May 2010 at 18:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-045
Project: Auto Assign Role (third-party module)
Version: 6.x
Date: 2010-May-12
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-044: Bibliography - Cross Site Scripting

By Drupal Security Team on 12 May 2010 at 18:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-044
Project: Bibliography (third-party module)
Version: 5.x, 6.x
Date: 2010-May-12
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-043: Wordfilter - Cross Site Scripting

By Drupal Security Team on 12 May 2010 at 18:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-043
Project: Wordfilter (third-party module)
Version: 5.x, 6.x
Date: 2010-May-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-042: LoginToboggan - Session fixation

By Drupal Security Team on 12 May 2010 at 17:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-042
Project: LoginToboggan (third-party module)
Version: 5.x, 6.x
Date: 2010-05-12
Security risk: Critical
Exploitable from: Remote
Vulnerability: Session fixation

SA-CONTRIB-2010-041: ImageField - Access Bypass

By Drupal Security Team on 6 May 2010 at 00:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-041
Project: ImageField (third-party module)
Version: 6.x
Date: 2010-May-5
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-040: FileField - Access Bypass

By Drupal Security Team on 6 May 2010 at 00:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-040
Project: FileField (third-party module)
Version: 6.x
Date: 2010-May-5
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-039: CCK TableField - Cross Site Scripting

By Drupal Security Team on 5 May 2010 at 22:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-039
Project: CCK TableField (third-party module)
Version: 6.x
Date: 2010-May-05
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-038 - Privatemsg - Access bypass

By Drupal Security Team on 28 Apr 2010 at 20:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-038
Project: Privatemsg (third-party module)
Version: 6.x
Date: 2010-April-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-037 - Decisions - Access bypass

By Drupal Security Team on 28 Apr 2010 at 18:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-037
Project: Decisions (third-party module)
Version: 5.x, 6.x
Date: 2010-April-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-036 - Views - multiple vulnerabilities

By pwolanin on 8 Apr 2010 at 00:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-036
Project: Views (third-party module)
Version: 5.x, 6.x
Date: 2010-April-7
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS), arbitrary code execution

SA-CONTRIB-2010-035: Smileys - Cross Site Request Forgery

By Drupal Security Team on 7 Apr 2010 at 22:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-035
Project: Smileys (third-party module)
Versions: 5.x
Date: 2010-April-07
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-034 - Internationalization - Cross Site Scripting

By Drupal Security Team on 7 Apr 2010 at 22:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-034
Project: Internationalization (third-party module)
Version: 6.x
Date: 2010-April-7
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-033 - Taxonomy Filter - Cross Site Scripting (XSS)

By Drupal Security Team on 31 Mar 2010 at 20:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-033
Project: Taxonomy Filter (third-party module)
Version: 6.x
Date: 2010-March-31
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-032 - Taxonomy Breadcrumb - Cross Site Scripting (XSS)

By Drupal Security Team on 31 Mar 2010 at 15:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-032
Project: Taxonomy Breadcrumb (third-party module)
Versions: 6.x-1.x, 5.x-1.x
Date: 2010-March-31
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-031 - Menu Block - Cross Site Scripting (XSS)

By Drupal Security Team on 24 Mar 2010 at 23:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-031
Project: Menu Block (third-party module)
Versions: 6.x-2.x, 5.x-2.x, 5.x-1.x
Date: 2010-March-24
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-030: Mime Mail - Arbitrary code execution

By Drupal Security Team on 24 Mar 2010 at 18:00 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-030
Project: Mime Mail (third-party module)
Version: 5.x
Date: 2010-March-24
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-029: Keys - Cross-site Request Forgery

By Drupal Security Team on 17 Mar 2010 at 20:43 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-029
Project: Keys (third-party module)
Version: 6.x
Date: 2010-March-17
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-028 - Tag Order - Cross Site Scripting

By Drupal Security Team on 17 Mar 2010 at 20:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-028
Project: Tag Order (third-party module)
Version: 5.x, 6.x
Date: 2010-March-17
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-027: Email Input Filter - Arbitrary code execution

By Drupal Security Team on 17 Mar 2010 at 20:41 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-027
Project: Email Input Filter (third-party module)
Version: 5.x, 6.x
Date: 2010-March-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-CONTRIB-2010-026 - Monthly Archive by Node Type - Access Bypass

By Drupal Security Team on 10 Mar 2010 at 16:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-026
Project: Monthly Archive by Node Type (third-party module)
Version: 6.x (all branches)
Date: 2010-March-10
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-025 - TinyMCE - Cross Site Scripting (XSS)

By greggles on 10 Mar 2010 at 14:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-025
Project: TinyMCE (third-party module)
Version: 5.x
Date: 2010-March-09
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CORE-2010-001 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 3 Mar 2010 at 19:31 UTC

Advisory ID: DRUPAL-SA-CORE-2010-001
Project: Drupal core
Version: 5.x, 6.x
Date: 2010-March-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Open redirect, Authorization vulnerability

SA-CONTRIB-2010-024 - eTracker - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 19:01 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-024
Project: eTracker (third-party module)
Version: 6.x-1.1
Date: 2010-March-03
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-023 - Workflow - Cross Site Scripting

By Drupal Security Team on 3 Mar 2010 at 18:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-023
Project: Workflow (third-party module)
Version: 6.x, 5.x
Date: 2010-March-03
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS