Security-news

security-news@drupal.org

1 participants
1782 discussions

Vendor Stream Wrapper - Critical - Unsupported - SA-CONTRIB-2022-019
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-019 Project: Vendor Stream Wrapper [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/vendor_stream_wrapper [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Cog - Critical - Unsupported - SA-CONTRIB-2022-018
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-018 Project: Cog [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/cog [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Media Entity Flickr - Critical - Unsupported - SA-CONTRIB-2022-017
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-017 Project: Media Entity Flickr [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/media_entity_flickr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Vocabulary Permissions Per Role - Critical - Unsupported - SA-CONTRIB-2022-016
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-016 Project: Vocabulary Permissions Per Role [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/vppr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Exif - Critical - Unsupported - SA-CONTRIB-2022-015
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-015 Project: Exif [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/exif [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Private Taxonomy Terms - Critical - Access bypass, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2022-014
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-014 Project: Private Taxonomy Terms [1] Date: 2022-January-26 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities Description: This module enables users to create 'private' vocabularies. The module doesn't sufficiently check user access permissions when attempting to view, edit, or add terms to vocabularies, including vocabularies not managed by the module. Partial mitigation is available by requiring users have been granted at least "Administer own taxonomy", "Edit own terms in vocabulary_name" or "Delete own terms in vocabulary_name" permissions, however this does not mitigate all known issues. Solution: Install the latest version: * If you use the Private Taxonomy Terms module for Drupal 8 or 9, upgrade to Private Taxonomy Terms 8.x-2.5 [3] * If you use the Private Taxonomy Terms module for Drupal 7.x, upgrade to Private Taxonomy Terms 7.x-1.11 [4] Reported By: * Conrad Lara [5] Fixed By: * Conrad Lara [6] * Greg Knaddison [7] of the Drupal Security Team * Chris [8] of the Drupal Security Team Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Chris [10] of the Drupal Security Team [1] https://www.drupal.org/project/private_taxonomy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/private_taxonomy/releases/8.x-2.5 [4] https://www.drupal.org/project/private_taxonomy/releases/7.x-1.11 [5] https://www.drupal.org/user/1790054 [6] https://www.drupal.org/user/1790054 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/1850070

1 0

Business Responsive Theme - Critical - Unsupported - SA-CONTRIB-2022-013
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-013 Project: Business Responsive Theme [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/business_responsive_theme [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Swiftype integration - Critical - Unsupported - SA-CONTRIB-2022-012
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-012 Project: Swiftype integration [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/swiftype [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Navbar - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-011
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-011 Project: Navbar [1] Date: 2022-January-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module provides a very simple, mobile-friendly navigation toolbar. The module doesn't sufficiently check for user-provided input. This vulnerability is mitigated by the fact that an attacker must have the ability to post content using a text format (like the default "Filtered HTML" format) that won't filter out the exploit code. Solution: Install the latest version: * If you use the Navbar module for Drupal 7.x, upgrade to Navbar 7.x-1.8 [3] Reported By: * Yonatan Offek [4] Fixed By: * Ivo Van Geertruyen [5] of the Drupal Security Team Coordinated By: * David Snopek [6] of the Drupal Security Team [1] https://www.drupal.org/project/navbar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/navbar/releases/7.x-1.8 [4] https://www.drupal.org/user/194009 [5] https://www.drupal.org/user/383424 [6] https://www.drupal.org/user/266527

1 0

Rate - Critical - Unsupported - SA-CONTRIB-2022-010
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-010 Project: Rate [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/rate [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news