Security advisories

Show advisories for only Drupal Core, only contributed projects, or only PSAs

DRUPAL-SA-2005-009 Bypass "view user profiles" permission

By dries on 30 Nov 2005 at 21:45 UTC

Advisory ID: DRUPAL-SA-2005-009
Project: Drupal core
Date: 2005-11-30
Security risk: not critical
Impact: normal
Where: from remote
Vulnerability: bypass access control

DRUPAL-SA-2005-008 XSS and HTTP header injection vulnerability with uploaded files

By dries on 30 Nov 2005 at 21:45 UTC

Advisory ID: DRUPAL-SA-2005-008
Project: Drupal core
Date: 2005-11-30
Security risk: less critical
Impact: normal
Where: from remote
Vulnerability: XSS, HTTP header injection

DRUPAL-SA-2005-007 XSS vulnerability in submitted content

By dries on 30 Nov 2005 at 21:45 UTC

Advisory ID: DRUPAL-SA-2005-007
Project: Drupal core
Date: 2005-11-30
Security risk: less critical
Impact: normal
Where: from remote
Vulnerability: XSS

Unintentionally logging credit card transactions

By chx on 31 Oct 2005 at 21:10 UTC

Advisory ID: DRUPAL-SA-2005-006
Project: ecommerce
Date: 2005-Oct-30
Security risk: critical
Impact: authorize_net module, which is a part of the ecommerce package
Exploitable from: local
Vulnerability: System is unintentionally logging credit card transactions, including card numbers.

SQL injection and PHP code execution

By chx on 3 Oct 2005 at 18:18 UTC

Advisory ID: DRUPAL-SA-2005-005
Project: flexinode
Date: 2005-Oct-03
Security risk: highly critical
Impact: flexinode module
Exploitable from: remote
Vulnerability: SQL injection and PHP execution by bypassing input format check

Pages

Subscribe with RSS