Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2009-094 - NGP COO/CWP Integration (crmngp) - Multiple Vulnerabilities

By coltrane on 4 Nov 2009 at 19:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-094
Project: NGP COO/CWP Integration (crmngp) (third-party module)
Version: 6.x
Date: 2009-November-4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-site scripting and Access bypass

SA-CONTRIB-2009-093 - Temporary Invitation - Cross Site Scripting

By meba on 4 Nov 2009 at 19:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-093
Project: Temporary Invitation (third-party module)
Version: 5.x
Date: 2009 November 4
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-092 - S5 Presentation Player Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 19:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-092
Project: S5 Presentation Player (third-party module)
Version: 6.x
Date: 2009 November 4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-091 - Node Hierarchy - Cross Site Scripting

By Drupal Security Team on 4 Nov 2009 at 19:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-091
Project: Node Hierarchy (third-party module)
Version: 6.x, 5.x
Date: 2009 November 4
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-090 - User Protect - Cross Site Request Forgery

By hunmonk on 4 Nov 2009 at 13:20 UTC

Advisory ID: SA-CONTRIB-2009-090
Project: User Protect (third-party module)
Version: 5.x, 6.x
Date: 2009-November-04
Security risk: Moderate
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-CONTRIB-2009-089 - Storm - Access Bypass

By greggles on 28 Oct 2009 at 22:43 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-089
Project: Storm (third-party module)
Version: 6.x
Date: 2009-October-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-088 - Workflow Multiple Cross Site Scripting Vulnerabilities

By greggles on 28 Oct 2009 at 22:02 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-088
Project: Workflow (third-party module)
Version: 6.x, 5.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-087 - FAQ Ask - Multiple Vulnerabilities

By greggles on 28 Oct 2009 at 21:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-087
Project: FAQ Ask (third-party module)
Version: 6.x
Date: 2009 October 28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple Vulnerabilities (XSS, CSRF, Open Redirect)

SA-CONTRIB-2009-086 - OpenSocial Shindig-Integrator - Cross Site Scripting

By Drupal Security Team on 28 Oct 2009 at 21:17 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-086
Project: OpenSocial Shindig-Integrator (third-party module)
Version: 6.x, 5.x
Date: 2009-October-86
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-085 - Insert Node - Cross Site Scripting

By Drupal Security Team on 28 Oct 2009 at 21:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-085
Project: Insert Node (third-party module)
Version: 5.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-084 - LDAP Integration - Multiple Vulnerabilities

By Drupal Security Team on 28 Oct 2009 at 20:57 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-084
Project: LDAP Integration (third-party module)
Version: 6.x, 5.x
Date: 2009-October-28
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-083 - CCK Comment Reference - Access Bypass

By Drupal Security Team on 28 Oct 2009 at 20:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-083
Project: CCK Comment Reference (third-party module)
Version: 6.x
Date: 2009-October-28
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2009-082 - Filefield module access bypass

By greggles on 21 Oct 2009 at 22:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-082
Project: FileField (third-party module)
Version: 6.x
Date: 2009-October-20
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-081 - Abuse - Cross Site Scripting

By meba on 21 Oct 2009 at 21:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-081
Project: Abuse (third-party module)
Version: 5.x, 6.x
Date: 2009 October 21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-080 - Simplenews Statistics - Multiple vulnerabilities

By Drupal Security Team on 21 Oct 2009 at 20:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-080
Project: Simplenews Statistics (third-party module)
Version: 6.x
Date: 2009 October 21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities (XSS, CSRF, Open Redirect)

SA-CONTRIB-2009-079 - vCard - Cross Site Scripting

By Drupal Security Team on 21 Oct 2009 at 20:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-079
Project: vCard module (third-party module)
Version: 6.x, 5.x
Date: 2009-October-21
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-078 - Moodle Course List - SQL Injection

By Drupal Security Team on 21 Oct 2009 at 20:23 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-078
Project: Moodle Course List module (third-party module)
Version: 6.x
Date: 2009-October-21
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2009-075 - OG Vocabulary 5.x

By greggles on 21 Oct 2009 at 19:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-075
Project: Organic Groups Vocabulary (third-party module)
Version: 5.x
Date: 2009-October-21
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-076 - Flag Content Cross Site Scripting

By kbahey on 21 Oct 2009 at 18:28 UTC

Advisory ID: SA-CONTRIB-2009-076
Project: Flag Content (third-party module)
Version: 5.x
Date: 2009-October-21
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

DRUPAL-SA-CONTRIB-2009-077 - Userpoints - Information disclosure

By Drupal Security Team on 21 Oct 2009 at 17:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-077
Project: Userpoints (third party module)
Version: 6.x
Date: 2009-October-21
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information disclosure

SA-CONTRIB-2009-074- Webform - Multiple vulnerabilities

By cwgordon7 on 15 Oct 2009 at 02:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-074
Project: Webform (third-party module)
Version: 5.x, 6.x
Date: 2009-October-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

DRUPAL-SA-CONTRIB-2009-073 - Printer, e-mail and PDF versions multiple vulnerabilities

By Drupal Security Team on 14 Oct 2009 at 23:05 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-073
Project: Printer, e-mail and PDF versions (third-party module)
Version: 5.x, 6.x
Date: 2009-October-14
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-072 - RealName - Cross Site Scripting

By drumm on 14 Oct 2009 at 22:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-072
Project: RealName (third-party module)
Version: 6.x
Date: 2009-October-14
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-071 - Organic Groups Vocabulary Access Bypass

By greggles on 14 Oct 2009 at 17:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-071
Project: OG Vocabulary (third party module)
Version: 6.x
Date: 2009-October-14
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-070 - Shibboleth authentication - Impersonation, privilege escalation

By coltrane on 14 Oct 2009 at 17:21 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-070
Project: Shibboleth authentication (third-party module)
Version: 6.x, 5.x
Date: 2009-October-14
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Impersonation, privilege escalation

SA-CONTRIB-2009-068 - Boost - Filesystem Directory Creation

By Drupal Security Team on 30 Sep 2009 at 20:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-068
Project: Boost (third-party module)
Version: 6.x-1.*
Date: 2009-09-30
Security risk: Low
Exploitable from: Remote
Vulnerability: Filesystem Directory Creation

SA-CONTRIB-2009-069 - Shared Sign On - Cross Site Scripting

By Drupal Security Team on 30 Sep 2009 at 20:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-069
Project: Shared Sign On (third-party module)
Version: 5.x, 6.x
Date: 2009 September 30
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-067 Dex module - Cross Site Scripting, no longer maintained

By Drupal Security Team on 30 Sep 2009 at 18:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-067
Project: Dex: Contact Information Manager (third-party module)
Version: 5.x, 6.x
Date: 2009-Sept-30
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-066 - Organic Groups - Cross Site Scripting

By Drupal Security Team on 30 Sep 2009 at 18:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-066
Project: Organic Groups (third-party module)
Version: 5.x, 6.x
Date: 2009-September-30
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-065 - Browscap - Cross Site Scripting

By greggles on 30 Sep 2009 at 17:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-065
Project: Browscap (third-party module)
Version: 5.x, 6.x
Date: 2009-September-30
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-064 - Bibliography module - Cross Site Scripting

By Drupal Security Team on 30 Sep 2009 at 16:19 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-064
Project: Bibliography module (third-party module)
Version: 6.x
Date: 2009-September-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-063 - XML sitemap - Cross Site Scripting

By Drupal Security Team on 30 Sep 2009 at 14:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-063
Project: XML sitemap (third-party module)
Version: 5.x
Date: 2009-September-30
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-062 - Devel - Cross Site Scripting

By Drupal Security Team on 23 Sep 2009 at 18:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-062
Project: Devel (third-party module)
Version: 5.x, 6.x
Date: 2009-September-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-061 - Markdown Preview - Cross Site Scripting

By Drupal Security Team on 23 Sep 2009 at 16:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-061
Project: Markdown Preview (third-party module)
Version: 6.x
Date: 2009 September 23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-060 - Meta tags (Nodewords) - Access bypass

By Drupal Security Team on 23 Sep 2009 at 15:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-060
Project: Meta tags / Nodewords (third-party module)
Version: 6.x
Date: 2009-September-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2009-008 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 16 Sep 2009 at 19:39 UTC

Advisory ID: DRUPAL-SA-CORE-2009-008
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-059 - OpenID - Multiple vulnerabilities

By Drupal Security Team on 16 Sep 2009 at 19:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-059
Project: OpenID (third-party module)
Version: 5.x
Date: 2009-September-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Impersonation, cross site request forgery

SA-CONTRIB-2009-058 - Comment RSS - Access bypass

By Drupal Security Team on 16 Sep 2009 at 16:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-058
Project: Comment RSS (third-party module)
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-057 - Date - Cross Site Scripting

By Drupal Security Team on 16 Sep 2009 at 14:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-057
Project: Date (third-party module)
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-056 - Node2Node, Node Browser, Subdomain Manager, Quota by role, Rest API with vulnerabilities, now abandoned

By Drupal Security Team on 9 Sep 2009 at 16:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-056
Project: Node2Node, Node Browser, Subdomain Manager, Quota by role, Rest API (third-party modules)
Version: 5.x, 6.x
Date: 2009 Sept 9
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-055 - BUEditor - Cross Site Scripting

By Drupal Security Team on 9 Sep 2009 at 16:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-055
Project: BUEditor (third-party module)
Version: 5.x, 6.x
Date: 2009 September 9
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-054 - Go - url redirects - Multiple vulnerabilities

By Drupal Security Team on 26 Aug 2009 at 19:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-054
Project: Go - url redirects (third-party module)
Versions: 5.x, 6.x
Date: 2009 August 26
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-053 - Ajax Table - Multiple vulnerabilities

By Drupal Security Team on 26 Aug 2009 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-053
Project: Ajax Table (third-party module)
Version: 5.x
Date: 2009-Aug-26
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-052 - Printer, e-mail and PDF versions - Cross site scripting

By Drupal Security Team on 20 Aug 2009 at 06:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-052
Project: Printer, e-mail and PDF versions (Print) (third-party modules)
Version: 5.x, 6.x
Date: 2009-August-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-051 - ImageCache - Multiple vulnerabilities

By Drupal Security Team on 19 Aug 2009 at 21:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-051
Project: ImageCache (third-party modules)
Version: 5.x, 6.x
Date: 2009-August-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-050 - Webform report - Cross site scripting

By Drupal Security Team on 5 Aug 2009 at 17:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-050
Project: Webform report (third-party module)
Version: All
Date: 2009-Aug-5
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-049 - Live - Privilege escalation, Impersonation

By Drupal Security Team on 29 Jul 2009 at 20:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-049
Project: Live (third-party module)
Version: 6.x
Date: 2009-July-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Impersonation, privilege escalation

SA-CONTRIB-2009-048 - Bibliography Module - Cross Site Scripting

By Drupal Security Team on 29 Jul 2009 at 19:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-048
Project: Bibliography Module (third-party module)
Version: 5.x, 6.x
Date: 2009-July-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-047 - Calendar - Cross Site Scripting

By Drupal Security Team on 29 Jul 2009 at 16:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-047
Project: Calendar (third-party module)
Version: 6.x
Date: 2009-July-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-046 - Date - Cross Site Scripting

By Drupal Security Team on 29 Jul 2009 at 16:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-046
Project: Date (third-party module)
Version: 6.x
Date: 2009-July-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

Pages

Subscribe with RSS