Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-CONTRIB-2009-062 - Devel - Cross Site Scripting

By Drupal Security Team on 23 Sep 2009 at 18:22 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-062
Project: Devel (third-party module)
Version: 5.x, 6.x
Date: 2009-September-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-061 - Markdown Preview - Cross Site Scripting

By Drupal Security Team on 23 Sep 2009 at 16:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-061
Project: Markdown Preview (third-party module)
Version: 6.x
Date: 2009 September 23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-060 - Meta tags (Nodewords) - Access bypass

By Drupal Security Team on 23 Sep 2009 at 15:08 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-060
Project: Meta tags / Nodewords (third-party module)
Version: 6.x
Date: 2009-September-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2009-008 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 16 Sep 2009 at 19:39 UTC

Advisory ID: DRUPAL-SA-CORE-2009-008
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-059 - OpenID - Multiple vulnerabilities

By Drupal Security Team on 16 Sep 2009 at 19:38 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-059
Project: OpenID (third-party module)
Version: 5.x
Date: 2009-September-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Impersonation, cross site request forgery

SA-CONTRIB-2009-058 - Comment RSS - Access bypass

By Drupal Security Team on 16 Sep 2009 at 16:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-058
Project: Comment RSS (third-party module)
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-057 - Date - Cross Site Scripting

By Drupal Security Team on 16 Sep 2009 at 14:55 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-057
Project: Date (third-party module)
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-056 - Node2Node, Node Browser, Subdomain Manager, Quota by role, Rest API with vulnerabilities, now abandoned

By Drupal Security Team on 9 Sep 2009 at 16:52 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-056
Project: Node2Node, Node Browser, Subdomain Manager, Quota by role, Rest API (third-party modules)
Version: 5.x, 6.x
Date: 2009 Sept 9
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-055 - BUEditor - Cross Site Scripting

By Drupal Security Team on 9 Sep 2009 at 16:50 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-055
Project: BUEditor (third-party module)
Version: 5.x, 6.x
Date: 2009 September 9
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-054 - Go - url redirects - Multiple vulnerabilities

By Drupal Security Team on 26 Aug 2009 at 19:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-054
Project: Go - url redirects (third-party module)
Versions: 5.x, 6.x
Date: 2009 August 26
Security risk: Highly Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-053 - Ajax Table - Multiple vulnerabilities

By Drupal Security Team on 26 Aug 2009 at 18:30 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-053
Project: Ajax Table (third-party module)
Version: 5.x
Date: 2009-Aug-26
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-052 - Printer, e-mail and PDF versions - Cross site scripting

By Drupal Security Team on 20 Aug 2009 at 06:29 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-052
Project: Printer, e-mail and PDF versions (Print) (third-party modules)
Version: 5.x, 6.x
Date: 2009-August-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-051 - ImageCache - Multiple vulnerabilities

By Drupal Security Team on 19 Aug 2009 at 21:06 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-051
Project: ImageCache (third-party modules)
Version: 5.x, 6.x
Date: 2009-August-19
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-050 - Webform report - Cross site scripting

By Drupal Security Team on 5 Aug 2009 at 17:31 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-050
Project: Webform report (third-party module)
Version: All
Date: 2009-Aug-5
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-049 - Live - Privilege escalation, Impersonation

By Drupal Security Team on 29 Jul 2009 at 20:37 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-049
Project: Live (third-party module)
Version: 6.x
Date: 2009-July-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Impersonation, privilege escalation

SA-CONTRIB-2009-048 - Bibliography Module - Cross Site Scripting

By Drupal Security Team on 29 Jul 2009 at 19:32 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-048
Project: Bibliography Module (third-party module)
Version: 5.x, 6.x
Date: 2009-July-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-047 - Calendar - Cross Site Scripting

By Drupal Security Team on 29 Jul 2009 at 16:47 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-047
Project: Calendar (third-party module)
Version: 6.x
Date: 2009-July-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-046 - Date - Cross Site Scripting

By Drupal Security Team on 29 Jul 2009 at 16:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-046
Project: Date (third-party module)
Version: 6.x
Date: 2009-July-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-045: Moderation - Cross Site Request Forgery

By Drupal Security Team on 22 Jul 2009 at 20:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-045
Project: Moderation (third-party module)
Version: 5.x, 6.x
Date: 2009-07-22
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-site Request Forgery

SA-CONTRIB-2009-044 - Bubbletimer - Multiple vulnerabilities

By john morahan on 22 Jul 2009 at 12:36 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-044
Project: Bubbletimer (third-party module)
Version: 6.x
Date: 2009-July-22
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-043 - Image Assist - Multiple vulnerabilities

By Drupal Security Team on 15 Jul 2009 at 22:48 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-043
Project: Image Assist (third-party module)
Version: 5.x, 6.x
Date: 2009-07-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Information disclosure

SA-CONTRIB-2009-042 - Submitted By - Cross Site Scripting

By Drupal Security Team on 15 Jul 2009 at 19:26 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-042
Project: Submitted By (third-party module)
Version: 6.x
Date: 2009-July-15
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-041 - Nodequeue - Access bypass

By Drupal Security Team on 8 Jul 2009 at 16:45 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-041
Project: Nodequeue (third-party module)
Version: 5.x, 6.x
Date: 2009-July-08
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CONTRIB-2009-040 - Advanced Forum - Multiple vulnerabilities

By Drupal Security Team on 1 Jul 2009 at 20:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-040
Project: Advanced Forum (third-party module)
Version: 5.x, 6.x
Date: 2009-July-1
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CORE-2009-007 - Drupal core - Multiple vulnerabilities

By Drupal Security Team on 1 Jul 2009 at 20:56 UTC

Advisory ID: DRUPAL-SA-CORE-2009-007
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-July-1
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-039 - Links Package - Cross Site Scripting

By Drupal Security Team on 25 Jun 2009 at 15:46 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-039
Project: Links Package (third-party module)
Version: 5.x, 6.x
Date: 2009-June-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-038 - Nodequeue - Multiple vulnerabilities

By Drupal Security Team on 10 Jun 2009 at 22:15 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-038
Project: Nodequeue (third-party module)
Version: 5.x, 6.x
Date: 2009-June-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-037 - Views - Multiple vulnerabilities

By Drupal Security Team on 10 Jun 2009 at 21:59 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-037
Project: Views
Versions: 6.x-2.x
Date: 2009-June-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting (XSS), Access Bypass

SA-CONTRIB-2009-036 - Services - Impersonation

By Drupal Security Team on 10 Jun 2009 at 21:07 UTC

Advisory ID: SA-CONTRIB-2009-036
Project: Services (third-party module)
Version: 6.x
Date: 2009 June 10
Security risk: Critical
Exploitable from: Remote
Vulnerability: Impersonation

SA-CONTRIB-2009-035 - Booktree - Cross site scripting

By Drupal Security Team on 10 Jun 2009 at 18:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-035
Project: Booktree (third-party module)
Version: 5.x, 6.x
Date: 2009-June-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-034 - Taxonomy manager - Cross site scripting

By Drupal Security Team on 10 Jun 2009 at 17:54 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-034
Project: Taxonomy manager (third-party module)
Version: 5.x, 6.x
Date: 2009-June-10
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-033 - Quiz - Cross site scripting

By Drupal Security Team on 3 Jun 2009 at 20:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-033
Project: Quiz (third-party module)
Version: 5.x, 6.x
Date: 2009-June-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-032 - Webform - Cross-site scripting

By Drupal Security Team on 3 Jun 2009 at 20:03 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-032
Project: Webform (third-party module)
Versions: 5.x, 6.x
Date: 2009-June-03
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting

SA-CONTRIB-2009-031 - Ajax Session - Multiple vulnerabilities

By Drupal Security Team on 27 May 2009 at 17:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-031
Project: Ajax Session (third-party module)
Version: 5.x
Date: 2009 May 27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-030 - Email Verification - Information disclosure / Cross Site Scripting

By Drupal Security Team on 20 May 2009 at 20:09 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-030
Project: Email Verification (third-party module)
Version: 5.x, 6.x
Date: 2009-May-20
Security risk: High
Exploitable from: Remote
Vulnerability: Information disclosure, Cross Site Scripting

SA-CONTRIB-2009-029 - Views Bulk Operations - Access Bypass

By Drupal Security Team on 20 May 2009 at 20:07 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-029
Project: Views Bulk Operations (third-party module)
Version: 5.x, 6.x
Date: 2009-May-20
Security risk: Medium
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2009-006 - Drupal core - Cross site scripting

By Drupal Security Team on 13 May 2009 at 19:47 UTC

Advisory ID: DRUPAL-SA-CORE-2009-006
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-May-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-028 - Feed Block - Cross Site Scripting

By Drupal Security Team on 13 May 2009 at 16:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-028
Project: Feed Block (third-party module)
Version: 6.x
Date: 2009-May-13
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross Site Scripting

SA-CONTRIB-2009-027 - Printer, e-mail and PDF versions - Cross-site scripting

By Drupal Security Team on 13 May 2009 at 16:40 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-027
Project: Printer, e-mail and PDF versions (third-party module)
Versions: 5.x, 6.x
Date: 2009-May-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-CONTRIB-2009-026 - LoginToboggan - Access bypass

By Drupal Security Team on 13 May 2009 at 16:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-026
Project: LoginToboggan (third-party module)
Version: 6.x
Date: 2009-May-13
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-CORE-2009-005 - Drupal core - Cross site scripting

By Drupal Security Team on 30 Apr 2009 at 01:48 UTC

Advisory ID: DRUPAL-SA-CORE-2009-005
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-April-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-CONTRIB-2009-025 - Fivestar - Cross-site request forgery

By Drupal Security Team on 29 Apr 2009 at 22:24 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-025
Project: Fivestar (third-party module)
Version: 5.x, 6.x
Date: 2009-April-29
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross-site request forgery

SA-CONTRIB-2009-023 - News Page - SQL injection

By Drupal Security Team on 29 Apr 2009 at 21:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-023
Project: News Page
Versions: 5.x
Date: 2009-April-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-CONTRIB-2009-022 - Exif - Cross Site Scripting

By Drupal Security Team on 29 Apr 2009 at 21:04 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-022
Project: Exif (third-party module)
Version: 5.x, 6.x
Date: 2009-April-29
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting

Description

The Exif module enables users to display EXIF tags in images on the site.

SA-CONTRIB-2009-024 - Node Access User Reference - Access Bypass

By Drupal Security Team on 28 Apr 2009 at 23:20 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-024
Project: Node Access User Reference (third-party module)
Version: 5.x, 6.x
Date: 2009-April-29
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

Description

SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting

By Drupal Security Team on 15 Apr 2009 at 21:49 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-021
Project: CCK comment reference (third-party module)
Version: 6.x
Date: 2009 April 15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-020 - Print - Cross site scripting

By Drupal Security Team on 15 Apr 2009 at 21:35 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-020
Project: Printer, e-mail and PDF versions (third-party module)
Version: 5.x, 6.x
Date: 2009-April-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-019 - Localization client - Cross site scripting

By Drupal Security Team on 15 Apr 2009 at 20:56 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-019
Project: Localization client (third-party module)
Versions: 5.x, 6.x
Date: 2009-April-15
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-018 - Feed element mapper - Cross site scripting

By Drupal Security Team on 26 Mar 2009 at 18:34 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-018
Project: Feed element mapper (third-party module)
Version: 5.x
Date: 2009-March-26
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross-site scripting (XSS)

SA-CONTRIB-2009-017 - Vote Up/Down - Cross-site request forgery

By Drupal Security Team on 25 Mar 2009 at 21:42 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2009-017
Project: Vote Up/Down (third-party module)
Version: 5.x, 6.x
Date: 2009-March-25
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross-site request forgery

Pages

Subscribe with RSS