Security advisories | Drupal.org

Show advisories for only Drupal Core, only contributed projects, or only PSAs

SA-2008-060 - Drupal core - Multiple vulnerabilities

By gábor hojtsy on 8 Oct 2008 at 21:43 UTC

Advisory ID: DRUPAL-SA-2008-060
Project: Drupal core
Versions: 5.x and 6.x
Date: 2008-October-8
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-059 - Brilliant Gallery - SQL Injection and Cross Site Scripting

By kbahey on 1 Oct 2008 at 20:24 UTC

Advisory ID: DRUPAL-SA-2008-059
Project: Brilliant Gallery (third-party module)
Versions: 5.x
Date: 2008-October-1
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection and Cross Site Scripting

SA-2008-058 - Brilliant Gallery - SQL Injection

By heine on 24 Sep 2008 at 22:42 UTC

Advisory ID: DRUPAL-SA-2008-058
Project: Brilliant Gallery (third-party module)
Versions: 5.x, 6.x
Date: 2008-September-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-2008-057 - Ajax Checklist - Multiple vulnerabilities

By heine on 24 Sep 2008 at 19:48 UTC

Advisory ID: DRUPAL-SA-2008-057
Project: Ajax Checklist (third-party module)
Versions: 5.x
Date: 2008-September-24
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection, Cross site scripting

SA-2008-056 - Simplenews - Cross site scripting

By heine on 24 Sep 2008 at 18:58 UTC

Advisory ID: DRUPAL-SA-2008-056
Project: Simplenews (third-party module)
Versions: 5.x, 6.x
Date: 2008-September-24
Security risk: Not Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-055 - Stock - Cross site scripting

By heine on 24 Sep 2008 at 18:13 UTC

Advisory ID: DRUPAL-SA-2008-055
Project: Stock (third-party module)
Versions: 6.x
Date: 2008-September-24
Security risk: Moderately Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-054 - Plugin Manager - Access bypass

By heine on 24 Sep 2008 at 16:54 UTC

Advisory ID: DRUPAL-SA-2008-054
Project: Plugin Manager (third-party module)
Versions: 6.x
Date: 2008-September-24
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-053 - Answers - Cross site scripting

By heine on 18 Sep 2008 at 13:31 UTC

Advisory ID: DRUPAL-SA-2008-053
Project: Answers (third-party module)
Versions: 5.x
Date: 2008-September-18
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-052 - Link To Us - Cross site scripting

By heine on 17 Sep 2008 at 19:13 UTC

Advisory ID: DRUPAL-SA-2008-052
Project: Link To Us (third-party module)
Versions: 5.x
Date: 2008-September-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-051 - Mailsave - Cross site scripting

By heine on 17 Sep 2008 at 17:20 UTC

Advisory ID: DRUPAL-SA-2008-051
Project: Mailsave (third-party module)
Versions: 5.x and 6.x
Date: 2008-September-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-050 - Mailhandler - SQL injection

By heine on 17 Sep 2008 at 16:31 UTC

Advisory ID: DRUPAL-SA-2008-050
Project: Mailhandler (third-party module)
Versions: 5.x and 6.x
Date: 2008-September-17
Security risk: Critical
Exploitable from: Remote
Vulnerability: SQL injection

SA-2008-049 - Talk - Multiple vulnerabilities

By heine on 17 Sep 2008 at 16:11 UTC

Advisory ID: DRUPAL-SA-2008-049
Project: Talk (third-party module)
Version: 5.x, 6.x
Date: 2008-September-17
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Node access bypass

SA-2008-048-b - CCK - Cross site scripting

By heine on 4 Sep 2008 at 19:43 UTC

Advisory ID: DRUPAL-SA-2008-048-b
Project: CCK (third-party module)
Version: 5.x
Date: 2008-Sep-04
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-047 - Drupal core - Multiple vulnerabilities

By heine on 13 Aug 2008 at 23:27 UTC

Advisory ID: DRUPAL-SA-2008-047
Project: Drupal core
Version: 5.x, 6.x
Date: 2008-August-13
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-046 - Drupal core - Session fixation

By heine on 23 Jul 2008 at 19:58 UTC

Advisory ID: DRUPAL-SA-2008-046
Project: Drupal core
Version: 5.x
Date: 2008-July-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Session fixation

SA-2008-045 - OpenID - Multiple vulnerabilities

By heine on 9 Jul 2008 at 22:08 UTC

Advisory ID: DRUPAL-SA-2008-045
Project: OpenID (third-party module)
Version: 5.x
Date: 2008-July-9
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting, Cross site request forgeries

SA-2008-044 - Drupal core - Multiple vulnerabilities

By heine on 9 Jul 2008 at 21:24 UTC

Advisory ID: DRUPAL-SA-2008-044
Project: Drupal core
Version: 5x, 6.x
Date: 2008-July-9
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-043 - Outline designer - Privilege escalation

By heine on 2 Jul 2008 at 20:56 UTC

Advisory ID: DRUPAL-SA-2008-043
Project: Outline designer (third-party module)
Version: 5.x
Date: 2008-July-2
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Privilege escalation

SA-2008-042 - Tinytax - Cross site scripting

By heine on 2 Jul 2008 at 20:51 UTC

Advisory ID: DRUPAL-SA-2008-042
Project: Tinytax taxonomy block (third-party module)
Version: 5.x
Date: 2008-July-2
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-041 - Taxonomy autotagger - Multiple vulnerabilities

By heine on 2 Jul 2008 at 20:48 UTC

Advisory ID: DRUPAL-SA-2008-041
Project: Taxonomy autotagger (third-party module)
Version: 5.x
Date: 2008-July-2
Security risk: Critical
Exploitable from: Remote
Vulnerability: Cross site scripting and SQL injection

SA-2008-040 - Organic Groups - Cross site scripting and information disclosure

By moshe weitzman on 2 Jul 2008 at 20:42 UTC

Advisory ID: DRUPAL-SA-2008-040
Project: Organic Groups (third-party module)
Versions: 5.x and 6.x
Date: 2008-July-02
Security risk: Less Critical
Exploitable from: Remote
Vulnerability: Cross site scripting and information disclosure

SA-2008-039 - Suggested terms - Cross site scripting

By heine on 25 Jun 2008 at 18:53 UTC

Advisory ID: SA-2008-039
Project: Suggested terms (third-party module)
Versions: 5.x
Date: 2008-June-25
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-038 - Services - Arbitrary code execution

By heine on 18 Jun 2008 at 21:50 UTC

Advisory ID: DRUPAL-SA-2008-038
Project: Services (third-party module)
Versions: 5.x and 6.x
Date: 2008-June-18
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-2008-037 - TrailScout - XSS and SQL injection

By killes@www.drop.org on 18 Jun 2008 at 21:07 UTC

Advisory ID: DRUPAL-SA-2008-037
Project: TrailScout (third-party module)
Version: 5.x
Date: 2008-June-18
Security risk: Higly critical
Exploitable from: Remote
Vulnerability: Cross site scripting and SQL injection

SA-2008-036 - Profile search - SQL Injection

By heine on 18 Jun 2008 at 15:15 UTC

Advisory ID: SA-2008-036
Project: Profile Search (third-party module)
Versions: 5.x
Date: 2008-July-18
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-035 - Aggregation - Multiple vulnerabilities

By heine on 11 Jun 2008 at 19:44 UTC

Advisory ID: SA-2008-035
Project: Aggregation (third-party module)
Versions: 5.x
Date: 2008-June-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

SA-2008-034 - Node Hierarchy - Access bypass

By heine on 11 Jun 2008 at 19:24 UTC

Advisory ID: SA-2008-034
Project: Node Hierarchy (third-party module)
Versions: 5.x and 6.x
Date: 2008-June-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-033 - Taxonomy Image - Cross site scripting

By heine on 11 Jun 2008 at 16:11 UTC

Advisory ID: SA-2008-033
Project: Taxonomy Image (third-party module)
Versions: 5.x and 6.x
Date: 2008-June-11
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-032 - Magic Tabs - Arbitrary code execution

By heine on 11 Jun 2008 at 13:16 UTC

Advisory ID: SA-2008-032
Project: Magic Tabs (third-party module)
Versions: 5.x
Date: 2008-June-11
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution

SA-2008-031 - Pblog - Incorrect vulnerability report

By heine on 11 Jun 2008 at 12:31 UTC

Advisory ID: SA-2008-031
Project: Pblog (third-party module)
Versions: none
Date: 2008-June-11
Security risk: Not critical
Exploitable from: Remote
Subject: Incorrect vulnerability report

SA-2008-030 - Site Documentation - Privilege escalation

By heine on 14 May 2008 at 19:02 UTC

Advisory ID: DRUPAL-SA-2008-030
Project: Site Documentation (third-party module)
Versions: 5.x and 6.x
Date: 2008-May-14
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Privilege escalation

SA-2008-029 - E-Publish - Cross site scripting and Cross site request forgeries

By heine on 23 Apr 2008 at 20:34 UTC

Advisory ID: DRUPAL-SA-2008-029
Project: E-Publish (third-party module)
Versions: 5.x and 6.x
Date: 2008-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting and Cross site request forgeries

SA-2008-028 - Internationalization and Localizer - Cross site scripting

By heine on 23 Apr 2008 at 18:16 UTC

Advisory ID: DRUPAL-SA-2008-028
Project: Internationalization and Localizer (third-party modules)
Versions: 5.x and 6.x
Date: 2008-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-027 - Ubercart - Cross site scripting

By heine on 23 Apr 2008 at 18:16 UTC

Advisory ID: DRUPAL-SA-2008-027
Project: Ubercart (third-party module)
Version: 5.x
Date: 2008-April-23
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-026 - Drupal core - Access bypass

By heine on 9 Apr 2008 at 20:25 UTC

Advisory ID: DRUPAL-SA-2008-026
Project: Drupal core
Version: 6.x
Date: 2008-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-025 - Simple access - Access bypass

By dww on 9 Apr 2008 at 17:42 UTC

Advisory ID: DRUPAL-SA-2008-025
Project: Simple access (third-party module)
Version: 5.x-1.*
Date: 2008-April-09
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-024 - Webform - Cross site scripting

By heine on 3 Apr 2008 at 03:57 UTC

Advisory ID: DRUPAL-SA-2008-024
Project: Webform (third-party module)
Version: 5.x, 6.x
Date: 2008-April-03
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-023 - Ubercart - Cross site scripting

By heine on 2 Apr 2008 at 20:13 UTC

Advisory ID: DRUPAL-SA-2008-023
Project: Ubercart (third-party module)
Version: 5.x
Date: 2008-April-02
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-022 - Flickr - Cross site scripting

By heine on 2 Apr 2008 at 20:06 UTC

Advisory ID: DRUPAL-SA-2008-022
Project: Flickr (third-party module)
Version: 5.x, 6.x
Date: 2008-April-02
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-021 - Live - Cross site request forgery

By heine on 20 Mar 2008 at 05:39 UTC

Advisory ID: DRUPAL-SA-2008-021
Project: Live (third-party module)
Version: 5.x
Date: 2008-March-23
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-2008-020 - Ubercart - Cross site scripting

By heine on 12 Mar 2008 at 21:06 UTC

Advisory ID: DRUPAL-SA-2008-020
Project: Ubercart (third-party module)
Version: 5.x
Date: 2008-March-12
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-019 - Refine by Taxonomy - Cross site scripting

By heine on 5 Mar 2008 at 21:00 UTC

Advisory ID: DRUPAL-SA-2008-019
Project: Refine by Taxonomy (third-party module)
Version: 5.x
Date: 2008-March-05
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Cross site scripting

SA-2008-018 - Drupal core - Cross site scripting

By gábor hojtsy on 27 Feb 2008 at 19:23 UTC

Advisory ID: DRUPAL-SA-2008-018
Project: Drupal core
Version: 6.0
Date: 2008-February-27
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple cross site scripting vulnerabilities

SA-2008-017 - Header image - Access bypass

By heine on 13 Feb 2008 at 19:22 UTC

Advisory ID: DRUPAL-SA-2008-017
Project: Header image (third-party module)
Version: 5.x-1.0
Date: 2008-February-13
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Access bypass

SA-2008-016 - OpenID - Incorrect claimed_id returned for OpenID 2.0

By walkah on 30 Jan 2008 at 22:40 UTC

Advisory ID: DRUPAL-SA-2008-016
Project: OpenID (third-party module)
Version: 5.x-1.0
Date: 2008-January-30
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Identity impersonation

SA-2008-015 - Comment Upload - Arbitrary file upload

By heine on 30 Jan 2008 at 20:41 UTC

Advisory ID: DRUPAL-SA-2008-015
Project: Comment upload (third-party module)
Version: 4.7.x, 5.x
Date: 2008-January-30
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary file upload

SA-2008-014 - Userpoints - Cross site request forgery

By heine on 30 Jan 2008 at 20:41 UTC

Advisory ID: DRUPAL-SA-2008-014
Project: Userpoints (third-party module)
Version: 4.7.x, 5.x-2.x, 5.x-3.x
Date: 2008-January-30
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site request forgery

SA-2008-013 - Project issue tracking - Arbitrary file upload

By dww on 30 Jan 2008 at 20:41 UTC

Advisory ID: DRUPAL-SA-2008-013
Project: Project issue tracking (third-party module)
Version: 4.7.x-1.x, 4.7.x-2.x, 5.x-1.x, 5.x-2.x
Date: 2008-January-30
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Arbitrary file upload

SA-2008-012 - Project issue tracking - XSS vulnerability in comment summary tables

By heine on 30 Jan 2008 at 20:41 UTC

Advisory ID: DRUPAL-SA-2008-012
Project: Project issue tracking (third-party module)
Version: 4.7.x-1.x, 4.7.x-2.x, 5.x-1.x, 5.x-2.x
Date: 2008-January-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross-site scripting (XSS)

SA-2008-011 - Securesite - Access bypass

By heine on 30 Jan 2008 at 20:39 UTC

Advisory ID: DRUPAL-SA-2008-011
Project: Secure Site (third-party module)
Version: 5.x-1.0, 4.7.x-1.0
Date: 2008-January-30
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass

Pages

Subscribe with RSS