Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2012-110 - Colorbox Node - Cross Site Scripting (XSS)
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679486 * Advisory ID: SA-CONTRIB-2012-110 * Project: Colorbox Node [1] (third-party module) * Version: 7.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Colorbox Node gives the user the ability to display ANY page inside a colorbox modal without the header and footer. The module accepts some settings from URL parameters and didn't sufficiently validate them before printing them to the browser, allowing malicious users to inject script code into the page. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Colorbox Node 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Colorbox Node [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Colorbox Node 7.x-2.2 [4] Also see the Colorbox Node [5] project page. -------- REPORTED BY --------------------------------------------------------- * Gerhard Killesreiter [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Dennis Blake [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Gerhard Killesreiter [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/colorbox_node [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/colorbox_node [4] http://drupal.org/node/1679410 [5] http://drupal.org/project/colorbox_node [6] http://drupal.org/user/83 [7] http://drupal.org/user/384543 [8] http://drupal.org/user/227 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-109 - Restrict node page view - Access bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679466 * Advisory ID: SA-CONTRIB-2012-109 * Project: Restrict node page view [1] (third-party module) * Version: 7.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to disable direct access to node pages (node/XXX) based on nodetypes and permissions. The module issues a NODE_ACCESS_ALLOW if it's permissions are met, but does not respect the "administer nodes" or "access own unpublished content" permissions. The consequence is that this module grants access to unpublished content to any role that has the "view any node page" or "view any node {type} page" permissions. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Restrict node page view 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Restrict node page view [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Restrict node page view module for Drupal 7.x, upgrade to Restrict node page view 7.x-1.2 [4] Also see the Restrict node page view [5] project page. -------- REPORTED BY --------------------------------------------------------- * Jake Bell [6] -------- FIXED BY ------------------------------------------------------------ * Jake Bell [7] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Chris Hales [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/restrict_node_page_view [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/restrict_node_page_view [4] http://drupal.org/node/1662724 [5] http://drupal.org/project/restrict_node_page_view [6] http://drupal.org/user/11219 [7] http://drupal.org/user/11219 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/347249 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-108 - Drag & Drop Gallery - Arbitrary PHP code execution
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679442 * Advisory ID: DRUPAL-SA-CONTRIB-2012-108 * Project: Drag & Drop Gallery [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass, Cross Site Request Forgery, SQL Injection, Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- /Important note: Most of the vulnerabilities discussed below can be exploited when the Drag & Drop Gallery module is disabled on a Drupal site. See Solution below for details./ The Drag & Drop Gallery creates a gallery node type that allows you add images to the gallery by dragging and dropping images from your local file system. The file handling the actual uploads contains a number of bugs. The combination of these bugs allows unauthenticated user to upload PHP-executable files to arbitrary locations. A script exploiting this vulnerability has been published. A succesful exploit requires the webserver to be configured in such a way that it either ignores the .htaccess in the files directory or is able to write to certain web-accessible directories that do not have this .htaccess protection. The module also contains other vulnerabilities such as Cross site scripting (XSS), SQL-injection, Access bypass and Cross site request forgery (CSRF). Though less severe, these vulnerabilities can also be used to get administrator level access to the site. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Drag & Drop Gallery 6.x versions Drupal core is not affected. If you do not use the contributed Drag & Drop Gallery [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ There is no version of the module that fixes these vulnerabilites. Disable *and remove* the module from your system. Important note: Most vulnerabilities can still be exploited when the module is disabled. Please join the issue in the public queue [4] to fix the problems. Also see the Drag & Drop Gallery [5] project page. -------- REPORTED BY --------------------------------------------------------- The vulnerability was publicly disclosed. An exploit exists. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. [1] http://drupal.org/project/dragdrop_gallery [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/dragdrop_gallery [4] http://drupal.org/node/1679444 [5] http://drupal.org/project/dragdrop_gallery [6] http://drupal.org/contact [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-107 - Search autocomplete - Access bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679422 * Advisory ID: SA-CONTRIB-2012-107 * Project: Search Autocomplete [1] (third-party module) * Version: 7.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module allows you to add autocomplete functionality to virtually any fields of a Drupal site. The module doesn't sufficiently protect access to the module admin page. This vulnerability is mitigated by the fact that the user can only access the page, disable an autocompletion or change priority order. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Search Autocomplete 7.x-2.x versions prior to 7.x-2.4. Drupal core is not affected. If you do not use the contributed Search Autocomplete [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Search Autocomplete module for Drupal 6.x, upgrade to Search Autocomplete 7.x-2.4 [4] Also see the Search Autocomplete [5] project page. -------- REPORTED BY --------------------------------------------------------- * Reuben Turk [6] (nick: rooby) -------- FIXED BY ------------------------------------------------------------ * Reuben Turk [7] the module maintainer * Dominique CLAUSE [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * Chris Hales [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/search_autocomplete [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/search_autocomplete [4] http://drupal.org/node/1649442 [5] http://drupal.org/project/search_autocomplete [6] http://drupal.org/user/10164 [7] http://drupal.org/user/10164 [8] http://drupal.org/user/801982 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/347249 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-106 - Listhandler - Access Bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679412 * Advisory ID: DRUPAL-SA-CONTRIB-2012-106 * Project: Listhandler [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Listhandler is a module that marries mailing list discussions and Drupal forums. The module doesn't sufficiently check the permissions of comment authors when importing emails. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All Listhandler 6.x-1.x versions. Drupal core is not affected. If you do not use the contributed Listhandler [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module. There is no fixed version. Also see the Listhandler [4] project page. -------- REPORTED BY --------------------------------------------------------- * Brian Swaney [5] -------- FIXED BY ------------------------------------------------------------ No release nor support for the advisory process was provided by the maintainer. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. [1] http://drupal.org/project/listhandler [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/listhandler [4] http://drupal.org/project/listhandler [5] http://drupal.org/user/608968 [6] http://drupal.org/contact [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-105 - Hashcash - Cross Site Scripting (XSS)
by security-news＠drupal.org 27 Jun '12

27 Jun '12

View online: http://drupal.org/node/1663306 * Advisory ID: DRUPAL-SA-CONTRIB-2012-105 * Project: Hashcash [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-June-27 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Hashcash project is an implementation of a Proof Of Work (POW) or Puzzle scheme where users of a service have to do computational work to have their request granted. In the case of the Drupal Hashcash project, the service is 'form submission' and the Proof Of Work is a token that causes a partial hash collision when concatenated with a given string. This is intended to stop spam submissions to a site. .... Cross Site Scripting When an invalid token is received and the setting "Log failed hashcash" is enabled, the invalid token is written to watchdog with incorrect placeholders. This enables an attacker to insert arbitrary scripts into certain pages displayed to administrators via the core module Database logging. Mitigation: The setting "Log failed hashcash" is disabled by default. .... Insufficient proof of work The Hashcash project also fails as a proper proof of work scheme: * 1 in 256 random answers will be accepted as the correct answer. * The discrepancy in resources between a legitimate user using the Javascript hash implementation and an optimal attacker using a GPGPU implementation makes the cost of calculating a Hashcash token negligible for the attacker. The protection against spambots offered by the Drupal Hashcash project hinges on the lack of interest on behalf of an attacker. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Hashcash 6.x-2.x versions prior to 6.x-2.6 * Hashcash 7.x-2.x versions prior to 7.x-2.2 Drupal core is not affected. If you do not use the contributed Hashcash [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ To solve the cross site scripting issue, install the latest version: * If you use the Hashcash module for Drupal 6.x, upgrade to Hashcash 6.x-2.6 [4] * If you use the Hashcash module for Drupal 7.x, upgrade to Hashcash 7.x-2.2 [5] There is no solution for the insufficient proof of work. You need to consider the consequences of this for your sites. Also see the Hashcash [6] project page. -------- REPORTED BY --------------------------------------------------------- * Heine Deelstra [7] -------- FIXED BY ------------------------------------------------------------ * Simon Rycroft [8], the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/hashcash [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/hashcash [4] http://drupal.org/node/1650784 [5] http://drupal.org/node/1650790 [6] http://drupal.org/project/hashcash [7] http://drupal.org/user/17943 [8] http://drupal.org/user/151544 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-104 - Privatemsg - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Jun '12

20 Jun '12

View online: http://drupal.org/node/1649346 * Advisory ID: DRUPAL-SA-CONTRIB-2012-104 * Project: Privatemsg [1] (third-party module) * Version: 7.x * Date: 2012-June-20 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Privatemsg module allows users to send private messages between to each other. The module doesn't sufficiently sanitize user names when creating messages. This vulnerability is mitigated by the fact that it is not possible to create insecure user names through the default user interface. The exploit is only possible in combination with another module that allows this, such as Realname [3] which allows site-builders to choose fields to display an alternative username. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Privatemsg 7.x-1.x versions prior to 7.x-1.3 Drupal core is not affected. If you do not use the contributed Privatemsg [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Privatemsg module for Drupal 7, upgrade to Privatemsg 7.x-1.3 [5] Also see the Privatemsg [6] project page. -------- REPORTED BY --------------------------------------------------------- * Dave Reid [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Sascha Grossenbacher [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Dave Reid [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/privatemsg [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/realname [4] http://drupal.org/project/privatemsg [5] http://drupal.org/node/1649338 [6] http://drupal.org/project/privatemsg [7] http://drupal.org/user/53892 [8] http://drupal.org/user/214652 [9] http://drupal.org/user/53892 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/102818 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-103 - Global Redirect - Open Redirect
by security-news＠drupal.org 13 Jun '12

13 Jun '12

View online: http://drupal.org/node/1633054 * Advisory ID: DRUPAL-SA-CONTRIB-2012-103 * Project: Global Redirect [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-June-13 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- This module improves SEO and usability of a site by redirecting visitors to user-friendly and search-engine-friendly URLs. The module does not sufficiently validate that a destination URL is internal to the site, allowing an attacker to disguise a malicious destination address as a query parameter passed to a legitimate site URL. This vulnerability is mitigated by the fact that a site must have the "non-clean to clean" redirect enabled; however, this is the default configuration. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Global Redirect 6.x-1.x versions prior to 6.x-1.4. * Global Redirect 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed Global Redirect [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Global Redirect module for Drupal 6.x, upgrade to Global Redirect 6.x-1.4 [4] * If you use the Global Redirect module for Drupal 7.x, upgrade to Global Redirect 7.x-1.4 [5] Also see the Global Redirect [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ben Johnson [7] (benpjohnson) * Justin Klein-Keane [8] (Justin_KleinKeane) * Joe Chambers [9] (myrapunzeled) -------- FIXED BY ------------------------------------------------------------ * Nicholas Thompson [10] the module maintainer * Dave Reid [11] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [12] of the Drupal Security Team * Dave Reid [13] of the Drupal Security Team * Michael Hess [14] of the Drupal Security Team * Dylan Tack [15] of the Drupal Security Team * David Rothstein [16] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [17]. Learn more about the Drupal Security team and their policies [18], writing secure code for Drupal [19], and securing your site [20]. [1] http://drupal.org/project/globalredirect [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/globalredirect [4] https://drupal.org/node/1378116 [5] https://drupal.org/node/1378118 [6] http://drupal.org/project/globalredirect [7] http://drupal.org/user/268889 [8] http://drupal.org/user/302225 [9] http://drupal.org/user/1228542 [10] http://drupal.org/user/59351 [11] http://drupal.org/user/53892 [12] http://drupal.org/user/36762 [13] http://drupal.org/user/53892 [14] http://drupal.org/user/102818 [15] http://drupal.org/user/96647 [16] http://drupal.org/user/124982 [17] http://drupal.org/contact [18] http://drupal.org/security-team [19] http://drupal.org/writing-secure-code [20] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-102 - Ubercart AJAX Cart - Potential Disclosure of user Session ID
by security-news＠drupal.org 13 Jun '12

13 Jun '12

View online: http://drupal.org/node/1633048 * Advisory ID: DRUPAL-SA-CONTRIB-2012-102 * Project: Ubercart AJAX Cart [1] (third-party module) * Version: 6.x * Date: 2012-June-13 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to replace the default Ubercart shopping cart block with an AJAX-enabled one. The module includes the user's current session ID in one of its JavaScript settings keys on every page load which could be intercepted if the user's connection is not over SSL. This vulnerability is mitigated by the fact that an attacker must gain read access to the HTML output of a page with the uc_ajax_cart block enabled in order to potentially hijack the user's session. The issue is only known to affect sites that use some additional form of caching for authenticated users that shares Javascript settings values which is not a common case. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * uc_ajax_cart 6.x-2.x versions prior to 6.x-2.1. Drupal core is not affected. If you do not use the contributed Ubercart AJAX Cart [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the uc_ajax_cart module for Drupal 6.x, upgrade to uc_ajax_cart 6.x-2.1 [4] Also see the Ubercart AJAX Cart [5] project page. -------- REPORTED BY --------------------------------------------------------- * Neil Bertram [6] -------- FIXED BY ------------------------------------------------------------ * Stewart Adam [7], the module maintainer * Gerhard Killesreiter [8] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/uc_ajax_cart [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/uc_ajax_cart [4] http://drupal.org/node/1619586 [5] http://drupal.org/project/uc_ajax_cart [6] http://drupal.org/user/154713 [7] http://drupal.org/user/586244 [8] http://drupal.org/user/83 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-101 - Protected Node - Access Bypass
by security-news＠drupal.org 13 Jun '12

13 Jun '12

View online: http://drupal.org/node/1632918 * Advisory ID: DRUPAL-SA-CONTRIB-2012-101 * Project: Protected node [1] (third-party module) * Version: 6.x * Date: 2012-June-13 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Protected Node module enables users to use a password to restrict access to an individual node or all nodes of a node type. The module doesn't sufficiently protect node access when nodes are accessed outside of the standard node view (i.e. node/1 is protected but other lists are not). CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Protected node 6.x-1.x versions prior to 6.x-1.6. Drupal core is not affected. If you do not use the contributed Protected node [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Protected node module for Drupal 6.x, upgrade to Protected node 6.x-1.6 [4] Also see the Protected node [5] project page. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [6] -------- FIXED BY ------------------------------------------------------------ * Alexis Wilke [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/protected_node [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/protected_node [4] http://drupal.org/node/1258034 [5] http://drupal.org/project/protected_node [6] http://drupal.org/user/633600 [7] http://drupal.org/user/356197 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news