Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

Webform Multiple File Upload - Critical - Unsupported - SA-CONTRIB-2019-090

Date:

2019-November-13

Security risk:

Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported

Commerce Ingenico - Critical - Unsupported - SA-CONTRIB-2019-089

Date:

2019-November-13

Security risk:

Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All

SendinBlue - Critical - Access bypass - SA-CONTRIB-2019-088

Date:

2019-November-13

Security risk:

Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All

Update: This module had an access bypass vulnerability which has now been addressed by the module’s current maintainers.

Original description

Make Meeting Scheduler - Critical - Unsupported - SA-CONTRIB-2019-087

Date:

2019-November-13

Security risk:

Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All

Webform Report - Critical - Unsupported - SA-CONTRIB-2019-086

Date:

2019-November-13

Security risk:

Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All

Nodequeue - Critical - Cross Site Scripting - SA-CONTRIB-2019-085

Date:

2019-November-13

Security risk:

Critical 16 ∕ 25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All

Updated November 22.

This module enables you to collect nodes in an arbitrarily ordered list.

Nodequeue's JavaScript can be leveraged to insert HTML from attacker-controlled JSON data. This is exploitable if user-submitted "Filtered HTML" content is displayed on a page where nodequeue.js is loaded.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "manipulate queues".