- Security-news - lists.drupal.org

Hotel - Critical - Unsupported - SA-CONTRIB-2018-034
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-034 Project: Hotel [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: Drew Webber [4] [1] https://www.drupal.org/project/hotel [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/mcdruid

1 0

iShopping - Critical - Unsupported - SA-CONTRIB-2018-033
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-033 Project: iShopping [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: Drew Webber [4] [1] https://www.drupal.org/project/ishopping [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/mcdruid

1 0

Corporate Site - Critical - Unsupported - SA-CONTRIB-2018-032
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-032 Project: Corporate Site [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: Drew Webber [4] [1] https://www.drupal.org/project/corporate_site [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/mcdruid

1 0

TB Nucleus - Critical - Unsupported - SA-CONTRIB-2018-031
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-031 Project: TB Nucleus [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: Drew Webber [4] [1] https://www.drupal.org/project/nucleus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/mcdruid

1 0

SimpleCrop - Critical - Unsupported - SA-CONTRIB-2018-030
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-030 Project: SimpleCrop [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: * Pere Orga [4] of the Drupal Security Team [1] https://www.drupal.org/project/simplecrop [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/2301194

1 0

Baidu Analytics - Critical - Unsupported - SA-CONTRIB-2018-029
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-029 Project: Baidu Analytics [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: * Mark Shropshire [4] [1] https://www.drupal.org/project/baidu_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/14767

1 0

Protected Pages - Critical - Unsupported - SA-CONTRIB-2018-028
by security-news＠drupal.org 23 May '18

23 May '18

View online: https://www.drupal.org/sa-contrib-2018-028 Project: Protected Pages [1] Date: 2018-May-23 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use this module, you should uninstall it. Reported By: * Youri van Koppen [4] [1] https://www.drupal.org/project/protected_pages [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/654114

1 0

SVG Formatter - Critical - Cross Site Scripting - SA-CONTRIB-2018-027
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-027 Project: SVG Formatter [1] Date: 2018-May-09 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross Site Scripting Description: This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded. Solution: Install the latest version: * If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.06 [3] Also see the SVG Formatter [4] project page. Reported By: * Balazs Janos Tatar [5] Fixed By: * Balazs Janos Tatar [6] * Rick Manelius [7] of the Drupal Security Team * Goran Nikolovski [8] Coordinated By: * Balazs Janos Tatar [9] [1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/svg_formatter/releases/8.x-1.06 [4] https://www.drupal.org/project/svg_formatter [5] https://www.drupal.org/user/649590 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/680072 [8] https://www.drupal.org/user/3451979 [9] https://www.drupal.org/user/649590

1 0

Multi-Step Registration - Critical - Unsupported Module - SA-CONTRIB-2018-023
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-023 Project: Multi-Step Registration [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Module Description: With Multi-Step Registration you can create multi-step (wizard) user account registration forms. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the step module for Drupal you should uninstall it. Reported By: Ayesh Karunaratne [4] Fixed By: N/A [1] https://www.drupal.org/project/step [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/Ayesh

1 0

KCFinder integration - Critical - Unsupported Module - SA-CONTRIB-2018-024
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-024 Project: KCFinder integration [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Module Description: KCFinder is a multi-language file / image manager you can use to easily select, insert, upload and arrange images, flash movies, and other kinds of files. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the KCFinder integration you should uninstall it. Reported By: Neil Drumm [4] of the Drupal Security Team Fixed By: N/A [1] https://www.drupal.org/project/kcfinder [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/drumm

1 0