- Security-news - lists.drupal.org

SA-CONTRIB-2012-123 - Shibboleth authentication - Access Bypass
by security-news＠drupal.org 08 Aug '12

08 Aug '12

View online: http://drupal.org/node/1719462 * Advisory ID: DRUPAL-SA-CONTRIB-2012-123 * Project: Shibboleth authentication [1] (third-party module) * Version: 6.x * Date: 2012-August-8 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Shibboleth authentication module provides user authentication with Shibboleth single sign-on systems (both v1.3 and v2.0) as well as some authorization features (automatic role assignment based on Shibboleth attributes). The module doesn't sufficiently confirm the user's active status in Drupal when authenticating a user whose account could be blocked. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Shibboleth authentication all versions prior to 6.x-4.0-rc3. Drupal core is not affected. If you do not use the contributed Shibboleth authentication [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Shibboleth authentication module for Drupal 6.x, upgrade to Shibboleth authentication 6.x-4.0 [4] Shibboleth authentication releases for Drupal 7.x are not affected. Also see the Shibboleth authentication [5] project page. -------- REPORTED BY --------------------------------------------------------- * Brian Swaney [6] -------- FIXED BY ------------------------------------------------------------ Fixed by newer releases. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/shib_auth [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/shib_auth [4] http://drupal.org/node/1332976 [5] http://drupal.org/project/shib_auth [6] http://drupal.org/user/608968 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-122 - Better Revisions - Cross Site Scripting (XSS)
by security-news＠drupal.org 08 Aug '12

08 Aug '12

View online: http://drupal.org/node/1719402 * Advisory ID: DRUPAL-SA-CONTRIB-2012-122 * Project: Better Revisions [1] (third-party module) * Version: 7.x * Date: 2012-August-08 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Better Revisions module changes the built-in revision log text area to a customizable select list with an optional description field. It also allows an administrator to make the list and/or description field required. The module doesn't sufficiently validate strings entered in the administration interface. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer better revisions". CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Better Revisions 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Better Revisions [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Better Revisions module for Drupal 7.x, upgrade to Better Revisions 7.x-1.1 [4] Also see the Better Revisions [5] project page. -------- REPORTED BY --------------------------------------------------------- * Klaus Purer [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Roy Baxter [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/better_revisions [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/better_revisions [4] http://drupal.org/node/1713378 [5] http://drupal.org/project/better_revisions [6] http://drupal.org/user/262198 [7] http://drupal.org/user/360394 [8] http://drupal.org/user/262198 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-121 - Shorten URLs - Cross Site Scripting (XSS)
by security-news＠drupal.org 08 Aug '12

08 Aug '12

View online: http://drupal.org/node/1719392 * Advisory ID: DRUPAL-SA-CONTRIB-2012-121 * Project: Shorten URLs [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-August-8 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Shorten URLs module provides an API to shorten URLs via many services like bit.ly and TinyURL, as well as a block and a page that provide an interface for easily shortening URLs. .... Cross Site Scripting via report The module doesn't sufficiently sanitize user input when displaying shortened URLs. This vulnerability is mitigated by several factors: * The Record Shortened URLs submodule must be installed * The Views module must /not/ be installed * An attacker must either have the "use Shorten URLs page" permission or access to the Shorten URLs block CVE: Requested .... Cross Site Scripting via Custom Services List There is an additional XSS vulnerability where the module doesn't sufficiently sanitize user input when displaying custom URL shortening services. This vulnerability is mitigated by the fact that the "Shorten URLs Custom Services" submodule must be enabled and the attacker must have the "administer Shorten URLs custom services" permission, which should not be given to non-administrators. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Shorten URLs 6.x-1.x versions prior to 6.x-1.13. * Shorten URLs 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Shorten URLs [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Shorten URLs module for Drupal 6.x, upgrade to Shorten URLs 6.x-1.13 [4] * If you use the Shorten URLs module for Drupal 7.x, upgrade to Shorten URLs 7.x-1.2 [5] Also see the Shorten URLs [6] project page. -------- REPORTED BY --------------------------------------------------------- * Zach Alexander [7] * Justin Klein Keane [8] -------- FIXED BY ------------------------------------------------------------ * Isaac Sukin [9], the module maintainer * Zach Alexander [10] * Justin Klein Keane [11] -------- COORDINATED BY ------------------------------------------------------ * Stella Power [12] of the Drupal Security Team * Greg Knaddison [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. [1] http://drupal.org/project/shorten [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/shorten [4] https://drupal.org/node/1719306 [5] https://drupal.org/node/1719310 [6] http://drupal.org/project/shorten [7] https://drupal.org/user/1972656 [8] https://drupal.org/user/302225 [9] https://drupal.org/user/201425 [10] https://drupal.org/user/1972656 [11] https://drupal.org/user/302225 [12] http://drupal.org/user/66894 [13] http://drupal.org/user/36762 [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-120 - Monthly Archive by Node Type - Access Bypass (unsupported)
by security-news＠drupal.org 01 Aug '12

01 Aug '12

View online: http://drupal.org/node/1708198 * Advisory ID: DRUPAL-SA-CONTRIB-2012-120 * Project: Monthly Archive by Node Type [1] (third-party module) * Version: 6.x * Date: 2012-August-1 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module generates a monthly archive and block for specified node types, as well as an archive and block for whichever collection of node types you specify. The module doesn't sufficiently ensure node access for sites that use a node access system. This vulnerability is mitigated by the fact that it only affects sites using a node_access module. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of the "montharchive" (Monthly Archive by Node Type [3]) module are affected. Drupal core is not affected. If you do not use the contributed Monthly Archive by Node Type [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Remove the module; all versions of the module are affected by this vulnerability. Also see the Monthly Archive by Node Type [5] project page. -------- REPORTED BY --------------------------------------------------------- * M Yaddoshi [6] -------- FIXED BY ------------------------------------------------------------ No fix was supplied. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/montharchive [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/montharchive [4] http://drupal.org/project/montharchive [5] http://drupal.org/project/montharchive [6] http://drupal.org/user/150240 [7] http://drupal.org/user/102818 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-119 - Excluded Users - Cross Site Scripting (XSS)
by security-news＠drupal.org 01 Aug '12

01 Aug '12

View online: http://drupal.org/node/1708058 * Advisory ID: DRUPAL-SA-CONTRIB-2012-119 * Project: Excluded Users [1] (third-party module) * Version: 6.x * Date: 2012-August-1 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Excluded Users is a helper module which allows administrators to select users to not appear in user listings. The module displays a list of user names and email addresses without sanitizing them. In the event that someone manages to insert malicious code into a user name or email address, this might lead to an XSS attack. This vulnerability is mitigated by the fact that the user name and email address are validated on creation by default but other user creation methods could create a vulnerability. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Excluded Users 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Excluded Users [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Excluded Users module for Drupal 6.x, upgrade to Excluded Users 6.x-1.1 [4] Also see the Excluded Users [5] project page. -------- REPORTED BY --------------------------------------------------------- * Fox [6] -------- FIXED BY ------------------------------------------------------------ * Ricky Morse [7] the 6.x module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team * Peter Wolanin [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/excluded_users [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/excluded_users [4] http://drupal.org/node/1702984 [5] http://drupal.org/project/excluded_users [6] http://drupal.org/user/426416 [7] http://drupal.org/user/37599 [8] http://drupal.org/user/102818 [9] http://drupal.org/user/49851 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-118 - Secure Login - Open Redirect
by security-news＠drupal.org 25 Jul '12

25 Jul '12

View online: http://drupal.org/node/1700594 * Advisory ID: DRUPAL-SA-CONTRIB-2012-118 * Project: Secure Login [1] (third-party module) * Version: 7.x * Date: 2012-July-25 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. In addition, Secure Login module by default redirects non-HTTPS GET requests for pages containing forms that it secures to the HTTPS site. The module does not sufficiently validate that a requested path is internal to the site, allowing an attacker to disguise a malicious destination address as a GET query parameter passed to a non-HTTPS site URL. This vulnerability is mitigated by the fact that the target site must render a form secured by Secure Login module on its 404 page, such as in a block. A default installation of Drupal 7 renders the user login block on the 404 page, and is thus vulnerable to the open redirect. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Secure Login 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Secure Login [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Secure Login module for Drupal 7.x, upgrade to Secure Login 7.x-1.3 [4]. Also see the Secure Login [5] project page. -------- REPORTED BY --------------------------------------------------------- * Albert Martin [6] -------- FIXED BY ------------------------------------------------------------ * Mark Burdett [7], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Heine Deelstra [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/securelogin [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/securelogin [4] https://drupal.org/node/1698988 [5] http://drupal.org/project/securelogin [6] https://drupal.org/user/1888132 [7] https://drupal.org/user/12302 [8] http://drupal.org/user/17943 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-117 - Location - Access Bypass
by security-news＠drupal.org 25 Jul '12

25 Jul '12

View online: http://drupal.org/node/1700588 * Advisory ID: DRUPAL-SA-CONTRIB-2012-117 * Project: Location [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-July-25 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Location module allows real-world geographic locations to be associated with Drupal nodes, including people, places, and other content. The Location Search sub-module adds a search page for searching for locations. The Location Search module fails to enforce content and user access permissions and node access restrictions, meaning any user can see any node or user results on the location search page. From now on users must have the "access content" permission and any relevant node access rights to see node based location results and the "view user profiles" and "view all user locations" permissions to see user based location results. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Location Search (Location sub-module) 6.x versions prior to 6.x-3.2. * Location Search (Location sub-module) 7.x versions prior to 7.x-3.0-alpha1. Drupal core is not affected. If you do not use the contributed Location [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Location Search (Location sub-module) module for Drupal 6.x, upgrade to Location 6.x-3.2 [4] * If you use the Location Search (Location sub-module) module for Drupal 7.x, upgrade to Location 7.x-3.0-alpha1 [5] Also see the Location [6] project page. -------- REPORTED BY --------------------------------------------------------- * Jon Daley [7] -------- FIXED BY ------------------------------------------------------------ * Reuben Turk [8] the module maintainer * Ankur Rishi [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team * Ben Jeavons [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/location [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/location [4] http://drupal.org/node/1699962 [5] http://drupal.org/node/1699984 [6] http://drupal.org/project/location [7] http://drupal.org/user/586142 [8] http://drupal.org/user/350381 [9] http://drupal.org/user/11703 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/91990 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-116 - Subuser Cross Site Request Forgery (CSRF) and Access Bypass
by security-news＠drupal.org 25 Jul '12

25 Jul '12

View online: http://drupal.org/node/1700584 * Advisory ID: DRUPAL-SA-CONTRIB-2012-116 * Project: Subuser [1] (third-party module) * Version: 6.x * Date: 2012-July-25 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Subuser module allows users to be given the permission to create subusers. The subusers may then be automatically assigned a role or roles. The parent user then has the ability to manage the subusers they have created. A parent user is allowed to assume the role of a subuser they created (switch users) without having the "switch subuser" permission. However, users are prevented from switching to subusers that were not created by them. Additionally users can be switched to a subuser without intending to do so via a Cross Site Request Forgery attack (CSRF). CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * subuser 6.x-1.x versions prior to 6.x-1.8. Drupal core is not affected. If you do not use the contributed Subuser [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Subuser module for Drupal 6.x, upgrade to Subuser 6.x-1.8 [4] Also see the Subuser [5] project page. -------- REPORTED BY --------------------------------------------------------- * Stella Power [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Jimmy Berry [7] the module maintainer * Lee Rowlands [8] -------- COORDINATED BY ------------------------------------------------------ * Stella Power [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Michael hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/subuser [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/subuser [4] http://drupal.org/node/1700550 [5] http://drupal.org/project/subuser [6] http://drupal.org/user/66894 [7] http://drupal.org/user/214218 [8] http://drupal.org/user/395439 [9] http://drupal.org/user/66894 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/102818 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-115 - Gallery formatter - Cross Site Scripting (XSS)
by security-news＠drupal.org 25 Jul '12

25 Jul '12

View online: http://drupal.org/node/1700578 * Advisory ID: DRUPAL-SA-CONTRIB-2012-115 * Project: Gallery formatter [1] (third-party module) * Version: 7.x * Date: 2012-July-25 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Gallery formatter provides a field formatter for images that turns the fields into jQuery galleries. The module did not properly escape input from the user before printing it to the browser, allowing malicious users to inject script code into the page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create the nodes / entities and the fields that use the formatter. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Gallery formatter 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Gallery formatter [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Gallery formatter module for Drupal 7.x, upgrade to Gallery formatter 7.x-1.2 [4] Also see the Gallery formatter [5] project page. -------- REPORTED BY --------------------------------------------------------- * Sudipta Bandyopadhyay [6] -------- FIXED BY ------------------------------------------------------------ * Manuel Garcia [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/galleryformatter [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/galleryformatter [4] http://drupal.org/node/1699744 [5] http://drupal.org/project/galleryformatter [6] http://drupal.org/user/140596 [7] http://drupal.org/user/213194 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-114 - Campaign Monitor - Cross Site Scripting (XSS)
by security-news＠drupal.org 19 Jul '12

19 Jul '12

View online: http://drupal.org/node/1691446 * Advisory ID: SA-CONTRIB-2012-114 * Project: Campaign Monitor [1] (third-party module) * Version: 6.x * Date: 2012-July-18 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to integrate Campaign Monitor into Drupal so you can give users the ability to subscribe and unsubscribe for your Campaign Monitor lists. The module doesn't sufficiently validate strings entered in the administration interface. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer campaignmonitor". CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Campaign Monitor 6.x-2.x versions prior to 6.x-2.5 Drupal core is not affected. If you do not use the contributed Campaign Monitor [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Campaign Monitor module for Drupal 6.x, upgrade to Campaign Monitor 6.x-2.5 [4] Also see the Campaign Monitor [5] project page. -------- REPORTED BY --------------------------------------------------------- * Andrey Tretyakov [6] -------- FIXED BY ------------------------------------------------------------ * Jesper Kristensen [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/campaignmonitor [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/campaignmonitor [4] http://drupal.org/node/1689790 [5] http://drupal.org/project/campaignmonitor [6] http://drupal.org/user/169459 [7] http://drupal.org/user/697210 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0