Security-news

security-news@drupal.org

1 participants
1782 discussions

TB Nucleus - Critical - Unsupported - SA-CONTRIB-2018-031
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-031 Project: TB Nucleus [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: Drew Webber [4] [1] https://www.drupal.org/project/nucleus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/mcdruid

1 0

SimpleCrop - Critical - Unsupported - SA-CONTRIB-2018-030
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-030 Project: SimpleCrop [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: * Pere Orga [4] of the Drupal Security Team [1] https://www.drupal.org/project/simplecrop [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/2301194

1 0

Baidu Analytics - Critical - Unsupported - SA-CONTRIB-2018-029
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-029 Project: Baidu Analytics [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: * Mark Shropshire [4] [1] https://www.drupal.org/project/baidu_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/14767

1 0

Protected Pages - Critical - Unsupported - SA-CONTRIB-2018-028
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-028 Project: Protected Pages [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: * Youri van Koppen [4] [1] https://www.drupal.org/project/protected_pages [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/654114

1 0

SVG Formatter - Critical - Cross Site Scripting - SA-CONTRIB-2018-027
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-027 Project: SVG Formatter [1] Date: 2018-May-09 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross Site Scripting Description: This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded. Solution: Install the latest version: * If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.06 [3] Also see the SVG Formatter [4] project page. Reported By: * Balazs Janos Tatar [5] Fixed By: * Balazs Janos Tatar [6] * Rick Manelius [7] of the Drupal Security Team * Goran Nikolovski [8] Coordinated By: * Balazs Janos Tatar [9] [1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/svg_formatter/releases/8.x-1.06 [4] https://www.drupal.org/project/svg_formatter [5] https://www.drupal.org/user/649590 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/680072 [8] https://www.drupal.org/user/3451979 [9] https://www.drupal.org/user/649590

1 0

Multi-Step Registration - Critical - Unsupported Module - SA-CONTRIB-2018-023
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-023 Project: Multi-Step Registration [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Module Description: With Multi-Step Registration you can create multi-step (wizard) user account registration forms. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the step module for Drupal you should uninstall it. Reported By: Ayesh Karunaratne [4] Fixed By: N/A [1] https://www.drupal.org/project/step [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/Ayesh

1 0

KCFinder integration - Critical - Unsupported Module - SA-CONTRIB-2018-024
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-024 Project: KCFinder integration [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Module Description: KCFinder is a multi-language file / image manager you can use to easily select, insert, upload and arrange images, flash movies, and other kinds of files. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the KCFinder integration you should uninstall it. Reported By: Neil Drumm [4] of the Drupal Security Team Fixed By: N/A [1] https://www.drupal.org/project/kcfinder [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/drumm

1 0

Simple Taxonomy Revision - Critical - Unsupported - SA-CONTRIB-2018-025
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-025 Project: Simple Taxonomy Revision [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: Simple Taxonomy Revision module enables revisions for taxonomy terms for Drupal 8. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the Simple Taxonomy Revision module you should uninstall it. Reported By: Balazs Janos Tatar [4] Fixed By: N/A [1] https://www.drupal.org/project/simple_revision [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/649590

1 0

Scrollable Content - Critical - Unsupported - SA-CONTRIB-2018-026
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-026 Project: Scrollable Content [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: Scrollable Content provides a scrolling functionality for your content. Scrollable Content will give you a nice content slider preview of your site's nodes, and provides some display options. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the Scrollable Content module you should uninstall it. Reported By: Balazs Janos Tatar [4] Fixed By: N/A [1] https://www.drupal.org/project/scrollable_content [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/649590

1 0

DRD Agent - Critical - PHP object injection - SA-CONTRIB-2018-022
by security-news＠drupal.org 25 Apr '18

25 Apr '18

View online: https://www.drupal.org/sa-contrib-2018-022 Project: DRD Agent [1] Date: 2018-April-25 Security risk: *Critical* 15∕25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: PHP object injection Description: This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for administrators in a central dashboard. The modules (DRD and DRD Agent) encrypt the data which is exchanged between them but in order to do so, they use the PHP serialize/unserialize functions instead of the json_encode/json_decode combination. As the unserialize function is called on unauthenticated content, this introduces a PHP object injection vulnerability. Solution: Install the latest version: * If you use the DRD module for Drupal 8.x, upgrade to DRD 8.x-3.14 [3] * If you use the DRD Agent module for Drupal 8.x, upgrade to DRD Agent 8.x-3.7 [4] * If you use the DRD Agent module for Drupal 7.x, upgrade to DRD Agent 7.x-3.5 [5] Reported By: * David Snopek [6] of the Drupal Security Team Fixed By: * David Snopek [7] of the Drupal Security Team * Jürgen Haas [8] Coordinated By: * David Snopek [9] of the Drupal Security Team [1] https://www.drupal.org/project/drd_agent [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/2965986 [4] https://www.drupal.org/node/2965984 [5] https://www.drupal.org/node/2965982 [6] https://www.drupal.org/user/266527 [7] https://www.drupal.org/user/266527 [8] https://www.drupal.org/user/168924 [9] https://www.drupal.org/user/266527

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news