Security-news

security-news@drupal.org

1 participants
1782 discussions

Smart Trim - Moderately critical - Cross site scripting - SA-CONTRIB-2019-092
by security-news＠drupal.org 11 Dec '19

11 Dec '19

View online: https://www.drupal.org/sa-contrib-2019-092 Project: Smart Trim [1] Version: 8.x-1.18.x-1.08.x-1.0-beta1 Date: 2019-December-11 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Description: The Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently filter text when certain options are selected. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when certain options are selected for the trimmed output. Solution: Install the latest version: * If you use the Smart Trim module for Drupal 8.x, upgrade to smart_trim-8.x-1.2 [3] Also see the Smart Trim [4] project page. Reported By: * Anne [5] * Adam Shepherd [6] Fixed By: * Anne [7] * Mark Casias [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team [1] https://www.drupal.org/project/smart_trim [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/smart_trim/releases/8.x-1.2 [4] https://www.drupal.org/project/smart_trim [5] https://www.drupal.org/u/ckaotik [6] https://www.drupal.org/user/2650563 [7] https://www.drupal.org/u/ckaotik [8] https://www.drupal.org/user/206687 [9] https://www.drupal.org/u/damienmckenna

1 0

Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2019-095
by security-news＠drupal.org 11 Dec '19

11 Dec '19

View online: https://www.drupal.org/sa-contrib-2019-095 Project: Permissions by Term [1] Date: 2019-December-11 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: The Permissions by Term module extends Drupal by functionality for restricting access to single nodes via taxonomy terms. The module doesn't sufficiently restrict access to node previews, when the Search API module is used to display nodes in search result lists. Solution: Install the latest version: * If you use the Permissions by Term module for Drupal 8.x, upgrade to Version 8.x-2.0 [3] * The settings have been refactored. They are now bundled in the "permissions_by_term.settings.yml" file. There are not so many settings, so you can simply visit PbT's settings page and set the settings manually. Like the setting for "single term restriction". Also see the Permissions by Term [4] project page. Reported By: * Tamás Nagy [5] Fixed By: * Peter Majmesku [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/permissions_by_term [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/permissions_by_term/releases/8.x-2.0 [4] https://www.drupal.org/project/permissions_by_term [5] https://www.drupal.org/user/2252152 [6] https://www.drupal.org/user/786132 [7] https://www.drupal.org/u/greggles

1 0

Webform - Critical - Multiple vulnerabilities - SA-CONTRIB-2019-096
by security-news＠drupal.org 11 Dec '19

11 Dec '19

View online: https://www.drupal.org/sa-contrib-2019-096 Project: Webform [1] Version: 7.x-4.207.x-4.20-rc17.x-4.197.x-4.19-rc17.x-4.187.x-4.18-rc17.x-4.177.x-4.17-rc17.x-4.167.x-4.16-rc17.x-4.157.x-4.15-rc17.x-4.147.x-4.137.x-4.127.x-4.117.x-4.107.x-4.97.x-4.87.x-4.77.x-4.67.x-4.57.x-4.47.x-4.37.x-4.27.x-4.17.x-4.07.x-4.0-rc67.x-4.0-rc57.x-4.0-rc47.x-4.0-rc37.x-4.0-rc27.x-4.0-rc17.x-4.0-beta37.x-4.0-beta27.x-4.0-beta17.x-4.0-alpha107.x-4.0-alpha97.x-4.0-alpha87.x-4.0-alpha77.x-4.0-alpha67.x-4.0-alpha57.x-4.0-alpha47.x-4.0-alpha37.x-4.0-alpha27.x-4.0-alpha17.x-3.28-rc17.x-3.277.x-3.27-rc17.x-3.267.x-3.26-rc17.x-3.257.x-3.247.x-3.237.x-3.227.x-3.217.x-3.207.x-3.197.x-3.187.x-3.177.x-3.167.x-3.157.x-3.137.x-3.127.x-3.117.x-3.107.x-3.97.x-3.87.x-3.77.x-3.67.x-3.4-beta17.x-3.3-beta17.x-3.0-beta87.x-3.0-beta77.x-3.0-beta67.x-3.0-beta57.x-3.0-beta47.x-3.0-beta37.x-3.0-beta2 Date: 2019-December-11 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Multiple vulnerabilities Description: This module enables you to create forms to collect information from users and report, analyze and distribute it by email. The 7.x-3.x module doesn't sufficiently sanitize token values taken from query strings. If a query string token is used as the value of a markup component, an attacker can inject JavaScript into a page. The 7.x-4.x module doesn't sufficiently protect against an attacker changing the submission identifier of a draft webform, thereby overwriting another user's submission. Confidential information is not disclosed, but information can be overwritten and therefore lost or forged. The 7.x-4.x vulnerability is mitigated by the fact that an attacker must have a role with permission to submit a webform and the webform must have the advanced form setting of either 'Show "Save draft" button' and/or "Automatically save as draft between pages and when there are validation errors". Neither of these two options are enabled by default. Anonymous users cannot submit drafts and therefore cannot exploit this vulnerability. Solution: Install the latest version: * If you use the Webform 3.x module for Drupal 7.x, upgrade to Webform 7.x-3.29 [3] or to Webform 7.x-4.21. * If you use the Webform 4.x module for Drupal 7.x, upgrade to Webform 7.x-4.21 [4] Reported By: * Robin De Herdt [5] * Ayesh Karunaratne [6] Fixed By: * Robin De Herdt [7] * Ayesh Karunaratne [8] * Liam Morland [9] * Dan Chadwick [10] * Roman Zimmermann [11] Coordinated By: * Greg Knaddison [12] of the Drupal Security Team * Michael Hess [13] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/7.x-3.29 [4] https://www.drupal.org/project/webform/releases/7.x-4.21 [5] https://www.drupal.org/user/3555113 [6] https://www.drupal.org/user/796148 [7] https://www.drupal.org/user/3555113 [8] https://www.drupal.org/user/796148 [9] https://www.drupal.org/user/493050 [10] https://www.drupal.org/user/504278 [11] https://www.drupal.org/user/865256 [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mlhess

1 0

Commerce Ingenico - Critical - Unsupported - SA-CONTRIB-2019-089
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-089 Project: Commerce Ingenico [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/commerce_ingenico [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Floating Button Menu - Critical - Unsupported - SA-CONTRIB-2019-091
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-091 Project: Floating Button Menu [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/float_btn_menu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Webform Multiple File Upload - Critical - Unsupported - SA-CONTRIB-2019-090
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-090 Project: Webform Multiple File Upload [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/webform_multifile [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

SendinBlue - Critical - Unsupported - SA-CONTRIB-2019-088
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-088 Project: SendinBlue [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/sendinblue [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Make Meeting Scheduler - Critical - Unsupported - SA-CONTRIB-2019-087
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-087 Project: Make Meeting Scheduler [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/makemeeting [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Webform Report - Critical - Unsupported - SA-CONTRIB-2019-086
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-086 Project: Webform Report [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/webform_report [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Nodequeue - Critical - Unsupported - SA-CONTRIB-2019-085
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-085 Project: Nodequeue [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/nodequeue [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news