The main purpose of the Entity Backup module is to keep a backup of deleted Drupal core entities and perform recovery of them.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
This module enables the user to set custom permissions per path.
The module doesn't perform sufficient checks on paths with dynamic arguments (like "node/1" or "user/2"), thereby allowing the site administrator to save custom permissions for paths that won't be protected. This could lead to an access bypass vulnerability if the site is relying on the Custom Permissions module to protect those paths.
This vulnerability is mitigated by the fact that it only occurs on sites which attempted to use the Custom Permissions module to protect dynamic paths.
The Drupal VChess module allows users to play a chess game.
The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466
This module enables you to show referenced entities in tabs.
The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content of the content type that is referenced.
This module provides an expandable tree widget for the Taxonomy Term Reference field in Drupal 7.
The module doesn't sufficiently sanitize the output of its own defined field formatter.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission that allows to edit terms of a taxonomy where the module handles its output.
This module integrates the Sagepay payment service.
Some of the URLs used while processing the payment are not sufficiently secured. This might allow attackers to resume a previously failed payment attempt or to view content that should only be shown after a succesful payment. This affects all payments in a Drupal installation with this module enabled (including payments made using other payment methods).
