Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2011-005 - AES encryption - Information disclosure

By Drupal Security Team on 2 Feb 2011 at 18:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-005
Project: AES (third-party module)
Version: 7.x
Date: 2011-February-02
Security risk: Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2011-004 - Multiple Vulnerabilities In Multiple Contributed Modules

By Drupal Security Team on 2 Feb 2011 at 18:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-004
Projects: Multiple third party modules - OG Forum, Open Legislation, PowerSQL
Version: 6.x
Date: 2011-February-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple (Information disclosure, Cross Site Scripting, Cross Site Request Forgery, SQL injection)

SA-CONTRIB-2011-003 - Janrain Engage (RPX) - Multiple Vulnerabilities

By Drupal Security Team on 19 Jan 2011 at 22:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-003
Project: Janrain Engage (formerly RPX) (third-party module)
Version: 6.x
Date: 2011-January-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting or Arbitrary Code Execution

SA-CONTRIB-2011-002 - Panels - Cross Site Scripting (XSS)

By Drupal Security Team on 13 Jan 2011 at 01:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-002
Project: Panels (third-party module)
Version: 6.x
Date: 2011-January-12
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2011-001 - Webform - SQL Injection

By Drupal Security Team on 10 Jan 2011 at 10:14 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2011-001
Project: Webform (third-party module)
Version: 6.x
Date: 2011-January-10
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2010-113 - Image - Cross Site Scripting

By Drupal Security Team on 22 Dec 2010 at 21:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-113
Project: Image (third-party module)
Version: 5.x, 6.x
Date: 2010-December-22
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-112 - oEmbed - Access Bypass

By Drupal Security Team on 22 Dec 2010 at 21:11 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-112
Project: oEmbed (third-party module)
Version: 6.x
Date: 2010-December-22
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-111 - Views - Cross Site Scripting

By Drupal Security Team on 15 Dec 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-111
Project: Views (third-party module)
Version: 6.x
Date: 2010-December-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-110 - Drupal For Firebug - Cross-site Request Forgery

By Drupal Security Team on 15 Dec 2010 at 19:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-110
Project: Drupal For Firebug (third-party module)
Version: 5.x, 6.x
Date: 2010-Dec-15
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-109 - Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam - Multiple Vulnerabilities

By Drupal Security Team on 8 Dec 2010 at 22:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-109
Projects: Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam (third-party module)
Version: 5.x and 6.x
Date: 2010-December-08
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-108 - Who Bought What|Ubercart - Multiple Vulnerabilities

By Drupal Security Team on 8 Dec 2010 at 21:25 UTC

DRUPAL-SA-CONTRIB-2010-108
Project: Who Bought What|Ubercart (third-party module)
Version: 6.x
Date: 2010-Dec-08
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Multiple Vulnerabilities

SA-CONTRIB-2010-107 - Services - Access bypass

By Drupal Security Team on 2 Dec 2010 at 02:20 UTC

DRUPAL-SA-CONTRIB-2010-107
Project: Services (third-party module)
Version: 6.x
Date: 2010-Dec-01
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-106 - Comment Edited - Cross Site Scripting

By Drupal Security Team on 1 Dec 2010 at 19:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-106
Project: Comment Edited (third-party module)
Version: 6.x
Date: 2010-Dec-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-105 - Outline Designer - Cross Site Request Forgery

By Drupal Security Team on 1 Dec 2010 at 18:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-105
Project: Outline Designer (third-party module)
Version: 6.x
Date: 2010-December-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2010-104 - Relevant Content - Information Disclosure

By Drupal Security Team on 18 Nov 2010 at 02:18 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-104
Project: Relevant Content (third-party module)
Version: 5.x, 6.x
Date: 2010-November-17
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2010-103 - Node Relativity - Multiple vulnerabilities

By Drupal Security Team on 11 Nov 2010 at 04:28 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-103
Project: Node Relativity (third-party module)
Version: 5.x, 6.x
Date: 2010-November-10
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross-Site Scripting, Cross Site Request Forgery, Access bypass

SA-CONTRIB-2010-102 - Category tokens - Cross Site Scripting

By Drupal Security Team on 10 Nov 2010 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-102
Project: Category tokens (third-party module)
Version: 6.x
Date: 2010-November-10
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-Site Scripting

SA-CONTRIB-2010-101 - Watcher - Multiple Vulnerabilities

By Drupal Security Team on 28 Oct 2010 at 04:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-101
Project: Watcher
Version: 5.x, 6.x
Date: 2010-October-27
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross-site Scripting and Cross-site Request Forgery

SA-CONTRIB-2010-100 - Ubuntu Drupal Theme - Directory traversal and information disclosure

By Drupal Security Team on 20 Oct 2010 at 18:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-100
Projects: Ubuntu Drupal Theme - Brown
Version: 5.x, 6.x
Date: 2010-October-20
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Directory traversal and information disclosure

SA-CONTRIB-2010-099 - Views Bulk Operations - Access Bypass

By Drupal Security Team on 6 Oct 2010 at 21:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-099
Project: Views Bulk Operations (third-party module)
Version: 6.x
Date: 2010-October-6
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2010-098 - Memcache - Multiple vulnerabilities

By Drupal Security Team on 29 Sep 2010 at 23:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-098
Project: memcache (third-party module)
Version: 5.x, 6.x
Date: 2010-September-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross-Site Scripting

Description

The Memcache project provides an alternative cache backend which works with memcached program to speed up high traffic sites.

SA-CONTRIB-2010-097 - Imagemenu - Multiple vulnerabilities

By Drupal Security Team on 29 Sep 2010 at 19:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-097
Project: Imagemenu (third-party module)
Version: 5.x, 6.x
Date: 2010-September-29
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-Site Scripting, Cross-site Request Forgery

SA-CONTRIB-2010-096 - Domain access - Multiple Vulnerabilities

By Drupal Security Team on 22 Sep 2010 at 21:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-096
Project: Domain access (third-party module)
Version: 5.x, 6.x, 7.x
Date: 2010-September-22
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-Site Scripting, Priviledge Escalation

SA-CONTRIB-2010-095 - Lightbox2 - Multiple Vulnerabilities

By Drupal Security Team on 22 Sep 2010 at 18:33 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-095
Project: Lightbox2 (third-party module)
Version: 5.x, 6.x
Date: 2010-September-22
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Access Bypass, Cross-Site Scripting

SA-CONTRIB-2010-094 - Embedded Media Field - Access bypass

By Drupal Security Team on 22 Sep 2010 at 18:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-094
Project: Embedded Media Field (third-party module)
Version: 5.x, 6.x
Date: 2010-September-22
Security risk: ~~Moderately Critical~~ Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-093 - Advanced Taxonomy Blocks - Multiple Vulnerabilities

By Drupal Security Team on 15 Sep 2010 at 19:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-093
Project: Advanced Taxonomy Blocks (third-party module)
Version: 6.x
Date: 2010-September-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2010-092 - Advanced Book Blocks - Multiple Vulnerabilities

By Drupal Security Team on 15 Sep 2010 at 19:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-092
Project: Advanced Book Blocks (third-party module)
Version: 6.x
Date: 2010-September-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting, Cross Site Request Forgery

SA-CONTRIB-2010-091 - Mollom - Information Disclosure

By Drupal Security Team on 15 Sep 2010 at 15:44 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-091
Project: Mollom (third-party module)
Version: 6.x
Date: 2010-September-15
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2010-090 - Yr Weatherdata - SQL Injection

By Drupal Security Team on 8 Sep 2010 at 17:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-090
Project: Yr Weatherdata (third-party module)
Version: 6.x
Date: 2010-September-08
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL Injection

SA-CONTRIB-2010-089 - Simplenews Content Selection - Cross Site Scripting

By Drupal Security Team on 18 Aug 2010 at 19:51 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-089
Project: Simplenews content selection (third-party module)
Version: 6.x
Date: 2010-August-18
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2010-088 - Content Construction Kit (CCK) - Access Bypass

By Drupal Security Team on 11 Aug 2010 at 23:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-088
Project: Content Construction Kit (CCK) (third-party module)
Version: 6.x
Date: 2010-August-11
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-087 - GovDelivery - Cross site scripting

By Drupal Security Team on 11 Aug 2010 at 22:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-087
Project: GovDelivery Integration (third-party module)
Version: 6.x
Date: 2010-Aug-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2010-086 - Prepopulate - Access Bypass

By Drupal Security Team on 11 Aug 2010 at 22:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-086
Project: Prepopulate (third-party module)
Version: 5.x and 6.x
Date: 2010-Aug-11
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Access Bypass

SA-CONTRIB-2010-085 - Pathauto - Cross Site Scripting

By Drupal Security Team on 11 Aug 2010 at 20:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-085
Project: Pathauto (third-party module)
Version: 5.x, 6.x
Date: 2010-August-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-084 - OpenID - Authentication bypass

By Drupal Security Team on 11 Aug 2010 at 19:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-084
Project: OpenID (third-party module)
Version: 5.x
Date: 2010-Aug-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Authentication bypass

SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 11 Aug 2010 at 19:53 UTC

Advisory ID: DRUPAL-SA-CORE-2010-002
Project: Drupal core
Version: 5.x, 6.x
Date: 2010-August-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2010-083 - Ubercart sub-modules - Multiple Vulnerabilities

By Drupal Security Team on 11 Aug 2010 at 18:39 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-083
Project: UC2Checkout, UCPaypal, UC Cart LInks (third-party modules in the Ubercart Project)
Version: 5.x, 6.x
Date: 2010-Aug-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access Bypass, Cross Site Request Forgery

SA-CONTRIB-2010-082 - Print - Local file read access

By Drupal Security Team on 11 Aug 2010 at 18:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-082
Project: Printer, e-mail and PDF versions (third-party module)
Version: 5.x, 6.x
Date: 2010-August-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Local file read access

SA-CONTRIB-2010-081 - FileField Sources - Arbitrary Code Execution

By Drupal Security Team on 11 Aug 2010 at 18:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-081
Project: FileField Sources (third-party module)
Version: 6.x
Date: 2010-August-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Arbitrary Code Execution

SA-CONTRIB-2010-080 - Privatemsg - Cross Site Scripting

By Drupal Security Team on 11 Aug 2010 at 13:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-080
Project: Privatemsg (third-party module)
Version: 6.x
Date: 2010-August-11
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-Site Scripting

SA-CONTRIB-2010-079 - Devel (Performance logging) - Cross Site Scripting

By kbahey on 4 Aug 2010 at 22:39 UTC

Advisory ID: SA-CONTRIB-2010-079
Project: Devel (third-party module)
Version: 5.x, 6.x
Date: 2010-Aug-04
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-078 - Kaltura - Information disclosure

By Drupal Security Team on 28 Jul 2010 at 22:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-078
Project: Kaltura (third-party module)
Versions: 5.x, 6.x
Date: 2010-July-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information disclosure

SA-CONTRIB-2010-077 - Sage Pay (former Protx) Direct Payment Gateway for Ubercart - Information Disclosure

By Drupal Security Team on 28 Jul 2010 at 17:25 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-077
Project: Sage Pay Direct Payment Gateway for Ubercart (third-party module)
Version: 5.x, 6.x
Date: 2010-July-28
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Information Disclosure

SA-CONTRIB-2010-076 - Dashboard - Cross Site Scripting (CSS)

By Drupal Security Team on 28 Jul 2010 at 16:11 UTC

Advisory ID: SA-CONTRIB-2010-076
Project: Dashboard (third-party module)
Version: 6.x
Date: 2010-July-28
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB 2010-075 - Tagging - Cross Site Scripting

By Drupal Security Team on 21 Jul 2010 at 18:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-075
Project: Tagging (third-party module)
Version: 6.x
Date: 2010-July 21
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-074 - Drupad - Cross-site request forgery

By Drupal Security Team on 14 Jul 2010 at 20:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-074
Projects: Drupad (third-party module)
Version: 6.x
Date: 2010-07-14
Security risks: Critical
Exploitable from: Remote
Vulnerability: CSRF

SA-CONTRIB-2010-073 - Multiple Vulnerabilities In Multiple Contributed Modules

By Drupal Security Team on 14 Jul 2010 at 20:27 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-073
Projects: Multiple third party modules - Simple Gallery, OG Menu, Tell A Friend Node, JsMath For Displaying Mathematics With TeX
Version: 5.x, 6.x
Date: 2010-July-14
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple (Cross Site Scripting, Email Header Injection)

SA-CONTRIB-2010-072: Hierarchical Select - Cross Site Scripting

By Drupal Security Team on 7 Jul 2010 at 16:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-072
Project: Hierarchical Select (third-party module)
Version: 5.x, 6.x
Date: 2010-July-07
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2010-071 - MultiSafepay Integration - Cross Site Request Forgery

By greggles on 7 Jul 2010 at 15:53 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-071
Project: MultiSafepay Integration (third-party module)
Version: 6.x
Date: 2010-July-07
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross Site Request Forgery

SA-CONTRIB-2010-070 - Multiple vulnerabilities in multiple contributed modules

By Drupal Security Team on 23 Jun 2010 at 20:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2010-070
Projects: Multiple third party modules - Easy Translator, Block Queue, Multiple Image Upload (Imagex)
Version: 5.x, 6.x
Date: 2010-06-23
Security risks: Critical
Exploitable from: Remote
Vulnerability: Multiple (SQL Injection, CSRF, Access bypass)

Pages

Subscribe with RSS