[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMYtjAqVfa_QgM5WjvG+gD5snNKp2p5RuGWn340XiGdT-D1AAg@mail.gmail.com>
Date: Thu, 29 Jan 2015 09:24:55 +0100
From: Pere Orga <pere@...a.cat>
To: kseifried@...hat.com, oss-security@...ts.openwall.com
Subject: Re: CVEs for Drupal contributed modules - January 2015
Hi again,
In my previous email a CVE request was wrong. "SA-CONTRIB-2015-031 -
GD Infinite Scroll - Open Redirect" should be discarded in favour of:
SA-CONTRIB-2015-032 - Node Invite - Open Redirect
https://www.drupal.org/node/2415899
Sorry for the confusion.
Many thanks
Pere Orga on behalf of the Drupal Security Team
On Thu, Jan 29, 2015 at 12:12 AM, Pere Orga <pere@...a.cat> wrote:
> Hi
>
> I would like to ask CVEs for the following advisories of Drupal
> contributed modules:
>
> SA-CONTRIB-2015-001 - OPAC - Cross-Site Request Forgery (CSRF)
> https://www.drupal.org/node/2403313
>
> SA-CONTRIB-2015-002 - Course - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2403333
>
> SA-CONTRIB-2015-003 - PHPlist Integration Module - SQL Injection
> https://www.drupal.org/node/2403343
>
> SA-CONTRIB-2015-004 - Context - Open Redirect
> https://www.drupal.org/node/2403351
>
> SA-CONTRIB-2015-005 - WikiWiki - SQL injection
> https://www.drupal.org/node/2403375
>
> SA-CONTRIB-2015-006 - Cloudwords for Multilingual Drupal - XSS
> SA-CONTRIB-2015-006 - Cloudwords for Multilingual Drupal - CSRF
> https://www.drupal.org/node/2403447
>
> SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2403445
>
> SA-CONTRIB-2015-008 - Batch Jobs - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2403451
>
> SA-CONTRIB-2015-009 - Linkit - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2403459
>
> SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2403463
>
> SA-CONTRIB-2015-011 - Todo Filter - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2403465
>
> SA-CONTRIB-2015-012 - Jammer - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2403487
>
> SA-CONTRIB-2015-013 - Field Display Label - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2403489
>
> SA-CONTRIB-2015-014 - Wishlist - XSS
> SA-CONTRIB-2015-014 - Wishlist - CSRF
> https://www.drupal.org/node/2407313
>
> SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2407315
>
> SA-CONTRIB-2015-016 - Tadaa! - CSRF
> SA-CONTRIB-2015-016 - Tadaa! - Open Redirect
> https://www.drupal.org/node/2407321
>
> SA-CONTRIB-2015-017 - Room Reservations - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2407329
>
> SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2407341
>
> SA-CONTRIB-2015-019 - Ubercart Currency Conversion - Open Redirect
> https://www.drupal.org/node/2407347
>
> SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2407357
>
> SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2407395
>
> SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2407401
>
> SA-CONTRIB-2015-023 - Classified Ads - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2411527
>
> SA-CONTRIB-2015-024 - Alfresco - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2411523
>
> SA-CONTRIB-2015-025 - Patterns - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2411539
>
> SA-CONTRIB-2015-026 - Taxonews - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2411573
>
> SA-CONTRIB-2015-027 - Quizzler - Cross Site Scripting (XSS)
> https://www.drupal.org/node/2411579
>
> SA-CONTRIB-2015-028 - Shibboleth Authentication - Cross Site Request
> Forgery (CSRF)
> https://www.drupal.org/node/2411737
>
> SA-CONTRIB-2015-029 - Corner - Cross Site Request Forgery (CSRF)
> https://www.drupal.org/node/2411741
>
> SA-CONTRIB-2015-030 - Amazon AWS - Access bypass
> https://www.drupal.org/node/2415873
>
> SA-CONTRIB-2015-031 - GD Infinite Scroll - XSS
> SA-CONTRIB-2015-031 - GD Infinite Scroll - CSRF
> SA-CONTRIB-2015-031 - GD Infinite Scroll - Open Redirect
> https://www.drupal.org/node/2415885
>
> SA-CONTRIB-2015-032 - Node Invite - XSS
> SA-CONTRIB-2015-032 - Node Invite - CSRF
> https://www.drupal.org/node/2415899
>
> SA-CONTRIB-2015-033 - Certify - Access bypass
> SA-CONTRIB-2015-033 - Certify - Information disclosure
> https://www.drupal.org/node/2415947
>
>
> Many thanks
> Pere Orga on behalf of the Drupal Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
