November 2012 - Security-news

SA-CONTRIB-2012-172 - Zero Point - Cross Site Scripting (XSS)
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853376 * Advisory ID: DRUPAL-SA-CONTRIB-2012-172 * Project: Zero Point [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-November-28 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Zero Point is an advanced theme which includes many options, ideal for a wide range of sites. The theme does not escape path aliases exposing a Cross site scripting (XSS) vulnerability in URLs. There are no mitigating factors. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * zeropoint 6.x-1.x versions prior to 6.x-1.18 * zeropoint 7.x-1.x versions prior to 7.x-1.4 Drupal core is not affected. If you do not use the contributed Zero Point [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Zero Point theme for Drupal 6.x, upgrade to zeropoint 6.x-1.18 [4] * If you use the Zero Point theme for Drupal 7.x, upgrade to zeropoint 7.x-1.4 [5] Also see the Zero Point [6] project page. -------- REPORTED BY --------------------------------------------------------- * samatha [7] -------- FIXED BY ------------------------------------------------------------ * Florian Radut [8] the module maintainer * Christian López Espínola [9] -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/zeropoint [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/zeropoint [4] http://drupal.org/node/1853358 [5] http://drupal.org/node/1853350 [6] http://drupal.org/project/zeropoint [7] http://drupal.org/user/534190 [8] http://drupal.org/user/35316 [9] http://drupal.org/user/959536 [10] http://drupal.org/user/262198 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-171 - Webmail Plus - SQL injection - (unsupported)
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853268 * Advisory ID: DRUPAL-SA-CONTRIB-2012-171 * Project: Webmail Plus [1] (third-party module) * Version: 6.x * Date: 2012-November-28 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: SQL Injection -------- DESCRIPTION --------------------------------------------------------- The Webmail plus module is a full-featured email client for Drupal. It's designed to provide email for any or all members of a Drupal site. The module doesn't sufficiently sanitize user input as it is used in a database query. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All Webmail Plus module versions. Drupal core is not affected. If you do not use the contributed Webmail Plus [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module: * If you use the Webmail Plus module you should disable the module. Also see the Webmail Plus [4] project page. -------- REPORTED BY --------------------------------------------------------- * Fox [5] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Gerhard Killesreiter [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/webmail_plus [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webmail_plus [4] http://drupal.org/project/webmail_plus [5] http://drupal.org/user/426464 [6] http://drupal.org/user/83 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-170 - MultiLink - Access Bypass
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853244 * Advisory ID: DRUPAL-SA-CONTRIB-2012-170 * Project: Multi-Language Link and Redirect (MultiLink) [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-November-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- MultiLink allows you to generate in-content links to a suitable node or node translation based on the visitor's language preferences. It allows the Node Title of the target node to be shown as the visible text and title attribute for the generated link. Prior to versions 6.x-2.7 and 7.x-2.7 the module doesn't check the the current user has access to a node referenced by the generated link, so that node title (only) may be disclosed to a user who would otherwise have no access to that node. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit text using an Input Format for which the MultiLink Filter has been enabled. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * MulitLink 6.x-2.x versions prior to 6.x-2.7 [3]. * MulitLink 7.x-2.x versions prior to 7.x-2.7 [4]. Drupal core is not affected. If you do not use the contributed Multi-Language Link and Redirect (MultiLink) [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version - see the project page http://drupal.org/project/multilink [6] for downloads. Also see the Multi-Language Link and Redirect (MultiLink) [7] project page. -------- REPORTED BY --------------------------------------------------------- * Andy Inman [8] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Andy Inman [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/multilink [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1289292 [4] http://drupal.org/node/1289294 [5] http://drupal.org/project/multilink [6] http://drupal.org/project/multilink [7] http://drupal.org/project/multilink [8] http://drupal.org/user/216383 [9] http://drupal.org/user/216383 [10] http://drupal.org/user/52142 [11] http://drupal.org/user/36762 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-169 - Email Field - Cross Site Scripting and Access bypass
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853214 * Advisory ID: DRUPAL-SA-CONTRIB-2012-169 * Project: Email Field [1] (third-party module) * Version: 6.x * Date: 2012-11-28 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass -------- DESCRIPTION --------------------------------------------------------- The email module provides a field type (CCK / FieldAPI) for storing email addresses and a formatter to output the email address as a link to a contact form. The contact form formatter allows a site visitor to email the stored address without letting them see what that e-mail address is. .... Access bypass The module didn't sufficiently check access for the contact form page, allowing a site visitor to email the stored address on the entity without having access to the field itself. This vulnerability is mitigated by needing to to use a field permission module (other than CCK's Content Permissions) with those email fields and need to have the field contact field formatter configured for either full or teaser display modes. CVE: Requested .... Cross Site Scripting Furthermore the mailto link wasn't sanitized when output to the screen. This vulnerability is mitigated by the fact that Drupal's form validation for emails prevents malicious emails and would need to be bypassed to exploit this vulnerability, e.g. by importing data from external sources and not doing validation. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Email Field 6.x-1.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed Email Field [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Email Field module for Drupal 6.x, upgrade to Email 6.x-1.4 [4] Also see the Email Field [5] project page. -------- REPORTED BY --------------------------------------------------------- * Fox (hefox) [6] -------- FIXED BY ------------------------------------------------------------ * Matthias Hutterer [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Fox (hefox) [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/email [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/email [4] http://drupal.org/node/1852612 [5] http://drupal.org/project/email [6] http://drupal.org/user/426416 [7] http://drupal.org/user/59747 [8] http://drupal.org/user/426416 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-168 - Services - Information Disclosure
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853200 * Advisory ID: DRUPAL-SA-CONTRIB-2012-168 * Project: Services [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-11-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to access content from a remote client. The module doesn't sufficiently adhere to standard Drupal permissions and exposes users emails via the user index method. This vulnerability is mitigated by the fact that an attacker most know the path to the user resource and must be able to access user profiles (have 'access user profiles' permission). CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Services 6.x-3.x versions prior to 6.x-3.3. * Services 7.x-3.x versions prior to 7.x-3.3. Drupal core is not affected. If you do not use the contributed Services [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Services module for Drupal 6.x, upgrade to Services 6.x-3.3 [4] * If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.3 [5] Also see the Services [6] project page. -------- REPORTED BY --------------------------------------------------------- * Fox (hefox) [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Fox (hefox) [8] of the Drupal Security Team * Kyle Browning [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Fox (hefox) [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/services [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/services [4] http://drupal.org/node/1842026 [5] http://drupal.org/node/1842022 [6] http://drupal.org/project/services [7] http://drupal.org/user/426416 [8] http://drupal.org/user/426416 [9] http://drupal.org/user/211387 [10] http://drupal.org/user/426416 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-167 - Mixpanel - Cross site scripting (XSS)
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853198 * Advisory ID: DRUPAL-SA-CONTRIB-2012-167 * Project: Mixpanel [1] (third-party module) * Version: 6.x * Date: 2012-November-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module provides integration with the Mixpanel real-time analytics service. The module doesn't sufficiently escape the Mixpanel token when adding the tracking Javascript to the page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages". CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Mixpanel 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Mixpanel [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mixpanel module for Drupal 6.x, upgrade to Mixpanel 6.x-1.1 [4] Also see the Mixpanel [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Snopek [6] -------- FIXED BY ------------------------------------------------------------ * wundo [7] the module maintainer * David Snopek [8] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/mixpanel [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/mixpanel [4] http://drupal.org/node/1852098 [5] http://drupal.org/project/mixpanel [6] http://drupal.org/user/266527 [7] http://drupal.org/user/25523 [8] http://drupal.org/user/266527 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-166 - Table of Contents - Access Bypass
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1841046 * Advisory ID: DRUPAL-SA-CONTRIB-2012-166 * Project: Table of Contents [1] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to generates a list of select header tags in a box that looks like a table of contents or summary. The links added to that box point to the headers so users can quickly access each section of your documents. The module doesn't sufficiently check for node access restrictions when displaying the table of contents in a block. This vulnerability is mitigated by the fact that an attacker must find a node that is not visible to him/her and yet displays its blocks including the table of contents block. In some Drupal installations, this can happen for unpublished nodes. Also, the attacker will only see the headers (content between H1 to H6 tags) appearing in the table of contents, not the entire page. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * tableofcontents 6.x-3.x versions prior to 6.x-3.8. Drupal core is not affected. If you do not use the contributed Table of Contents [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the table of contents module for Drupal 6.x, upgrade to tableofcontents 6.x-3.8 [4] Also see the Table of Contents [5] project page. -------- REPORTED BY --------------------------------------------------------- * Erik Webb [6] -------- FIXED BY ------------------------------------------------------------ * Erik Webb [7] the reporter * Alexis Wilke [8] the Drupal 6.x maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/tableofcontents [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/tableofcontents [4] http://drupal.org/node/1841026 [5] http://drupal.org/project/tableofcontents [6] http://drupal.org/user/273404 [7] http://drupal.org/user/273404 [8] http://drupal.org/user/356197 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840992 * Advisory ID: DRUPAL-SA-CONTRIB-2012-165 * Project: Chaos tool suite (ctools) [1] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Chaos tool suite is primarily a set of APIs and tools to improve the developer experience. The page manager node view task does not sufficiently escape node titles when setting the page title, allowing XSS. This vulnerability is partially mitigate by the node task being disabled by default and limited to users that have the ability to submit or edit nodes. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Chaos tool suite (ctools) 6.x-1.x versions prior to 6.x-1.10. Drupal core is not affected. If you do not use the contributed Chaos tool suite (ctools) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Chaos tool suite (ctools) module for Drupal 6.x, upgrade to Chaos tool suite (ctools) 6.x-1.10 [4] Also see the Chaos tool suite (ctools) [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justin KleinKeane [6] * Andrey Tretyakov [7] -------- FIXED BY ------------------------------------------------------------ * Earl Miles (merlinofchaos) [8] -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/ctools [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ctools [4] http://drupal.org/node/1841030 [5] http://drupal.org/project/ctools [6] http://drupal.org/user/302225 [7] http://drupal.org/user/169459 [8] http://drupal.org/user/26979 [9] http://drupal.org/user/262198 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-164 - Smiley module and Smileys module - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840892 * Advisory ID: DRUPAL-SA-CONTRIB-2012-164 * Project: Smiley [1] (third-party module) * Project: Smileys [2] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [3] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- These modules enable you to substitutes text emoticons, like :-), with images. These modules don't sufficiently sanitize user defined smiley acronyms before displaying smiley images. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer smiley". These two modules are based on the same codebase and Smiley was forked due to lack of new feature development in the Smileys project. This single Security Advisory covers the same issue in the code of both modules. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Smiley 6.x-1.x versions prior to 6.x-1.1. * Smileys 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Smiley [4] module, or the Smileys [5] module there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Smiley module for Drupal 6.x, upgrade to Smiley 6.x-1.1 [6] * If you use the Smileys module for Drupal 6.x, upgrade to Smileys 6.x-1.1 [7] Also see the Smiley [8] project page. -------- REPORTED BY --------------------------------------------------------- * Jimmy Axenhus [9] -------- FIXED BY ------------------------------------------------------------ * Yonas Yanfa [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/smiley [2] http://drupal.org/project/smileys [3] http://drupal.org/security-team/risk-levels [4] http://drupal.org/project/smiley [5] http://drupal.org/project/smileys [6] http://drupal.org/node/1840956 [7] http://drupal.org/node/1840954 [8] http://drupal.org/project/smiley [9] http://drupal.org/user/565562 [10] http://drupal.org/user/473174 [11] http://drupal.org/user/102818 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840740 * Advisory ID: DRUPAL-SA-CONTRIB-2012-162 * Project: RESTful Web Services [1] (third-party module) * Version: 7.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The module doesn't sufficiently verify POST requests thereby exposing a Cross Site Request Forgery vulnerability. This vulnerability is mitigated by the fact that an attacker must trick an authenticated user onto a page with a site-specific malicious HTML form submission. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * RESTWS 7.x-1.x versions prior to 7.x-1.1. * RESTWS 7.x-2.x versions prior to 7.x-2.0-alpha3. Drupal core is not affected. If you do not use the contributed RESTful Web Services [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the RESTWS 1.x module for Drupal 7.x, upgrade to RESTWS 7.x-1.1 [4] * If you use the RESTWS 2.x module for Drupal 7.x, upgrade to RESTWS 7.x-2.0-alpha3 [5] Also see the RESTful Web Services [6] project page. -------- REPORTED BY --------------------------------------------------------- * Damien Tournoud [7] of the Drupal Security Team * Klaus Purer [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Klaus Purer [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/restws [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/restws [4] http://drupal.org/node/1840722 [5] http://drupal.org/node/1840728 [6] http://drupal.org/project/restws [7] http://drupal.org/user/22211 [8] http://drupal.org/user/262198 [9] http://drupal.org/user/262198 [10] http://drupal.org/user/262198 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0