Skip to content

Commit 4a2c596

Browse files
G-RathG-Rath
committed
feat: generate advisories with new prefix
1 parent 4524056 commit 4a2c596

493 files changed

Lines changed: 28562 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/access_code/DRUPAL-CONTRIB-2025-028.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2025-028",
4+
"modified": "2025-04-02T17:02:32.000Z",
5+
"published": "2025-04-02T17:02:32.000Z",
6+
"aliases": [
7+
"CVE-2025-3129"
8+
],
9+
"details": "This module enables users to log in using a short access code instead of providing a username/password combination.\n\nThe module doesn't sufficiently protect against brute force attacks to guess a user's access code.\n\nThis vulnerability is mitigated by the fact that access code based logins are off by default and only enabled for accounts that enable it. Sites could mitigate the issue without updating by:\n\n1. disabling the access code login method for critical accounts\n2. monitor and prevent brute force attacks in other ways (for example, with a Web Application Firewall)",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/access_code"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.0.4"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.0.4"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.0.4"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2025-028"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Marcin Maruszewski (marcin maruszewski)",
47+
"contact": [
48+
"https://www.drupal.org/u/marcin-maruszewski"
49+
]
50+
}
51+
]
52+
}

‎advisories/access_code/DRUPAL-CONTRIB-2025-108.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2025-108",
4+
"modified": "2025-09-24T17:27:20.000Z",
5+
"published": "2025-09-24T17:27:20.000Z",
6+
"aliases": [
7+
"CVE-2025-10928"
8+
],
9+
"details": "This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the \"change own access code\" permission.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/access_code"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.0.5"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.0.5"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.0.5"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2025-108"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

‎advisories/acl/DRUPAL-CONTRIB-2023-034.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2023-034",
4+
"modified": "2023-08-23T18:45:47.000Z",
5+
"published": "2023-08-23T14:51:16.000Z",
6+
"aliases": [],
7+
"details": "The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.\n\nThe module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.\n\nAs this is an API module, it is only exploitable if a \"client\" module exposes the vulnerability. Details of some contributed client modules are given below. Custom modules using ACL could also expose the vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker typically needs an \"admin\"-type permission provided by one of ACL's client modules.\n\nKnown client modules include:\n\n* Forum Access\n* Flexi Access\n* Content Access\n\nCoordinated Security Advisories are being released for those client modules that have Security coverage.",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Packagist",
12+
"name": "drupal/acl"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.0.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.0.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.0.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2023-034"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Drew Webber",
45+
"contact": [
46+
"https://www.drupal.org/user/255969"
47+
]
48+
},
49+
{
50+
"name": "Samuel Mortenson",
51+
"contact": [
52+
"https://www.drupal.org/user/2582268"
53+
]
54+
}
55+
]
56+
}

‎advisories/acquia_connector/DRUPAL-CONTRIB-2019-014.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2019-014",
4+
"modified": "2023-08-11T19:23:01.000Z",
5+
"published": "2019-02-06T18:13:19.000Z",
6+
"aliases": [],
7+
"details": "Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automates the collection of site information to speed support communication and issue resolution. It is required for use with the Acquia Insight service.\n\nThe module does not properly enforce access control in a specific case, which can lead to disclosing information.\n\nThe vulnerability is mitigated by requiring the module diff feature to be enabled. This feature is enabled by default.",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Packagist",
12+
"name": "drupal/acquia_connector"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.16.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.16.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.16.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2019-014"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Samuel Mortenson",
45+
"contact": [
46+
"https://www.drupal.org/user/2582268"
47+
]
48+
}
49+
]
50+
}

‎advisories/acquia_dam/DRUPAL-CONTRIB-2024-025.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2024-025",
4+
"modified": "2025-02-20T19:13:15.000Z",
5+
"published": "2024-06-05T16:45:02.000Z",
6+
"aliases": [
7+
"CVE-2024-13261"
8+
],
9+
"details": "Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance.\n\nThe module doesn't sufficiently protect the ability to disconnect a site from DAM. While disconnected sites do not lose asset data in Drupal, it will prevent site editors from accessing the DAM until a site administrator re-authenticates the site. Some uncached media images may also fail to be fetched while disconnected.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/acquia_dam"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.0.13"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.0.13"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "1.1.0-beta1"
37+
},
38+
{
39+
"fixed": "1.1.0-beta3"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=1.1.0-beta1 <1.1.0-beta3"
44+
}
45+
}
46+
],
47+
"database_specific": {
48+
"affected_versions": "<1.0.13 || >=1.1.0-beta1 <1.1.0-beta3",
49+
"patched": true
50+
}
51+
}
52+
],
53+
"references": [
54+
{
55+
"type": "WEB",
56+
"url": "https://www.drupal.org/sa-contrib-2024-025"
57+
}
58+
],
59+
"credits": [
60+
{
61+
"name": "Matt Glaman",
62+
"contact": [
63+
"https://www.drupal.org/user/2416470"
64+
]
65+
}
66+
]
67+
}

‎advisories/acquia_dam/DRUPAL-CONTRIB-2025-105.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2025-105",
4+
"modified": "2025-09-03T16:15:48.000Z",
5+
"published": "2025-09-03T16:15:48.000Z",
6+
"aliases": [
7+
"CVE-2025-9954"
8+
],
9+
"details": "This module enables you to connect a Drupal site to the Acquia DAM service, which syncs media from the third party service to the site.\n\nThe module doesn't sufficiently validate authorization to a list of DAM assets currently synced to the website creating an access bypass vulnerability.\n\nThis vulnerability is mitigated by the fact that it only impacts sites where users having the \u201cview media\u201d permission accessing any DAM asset is undesirable.\n\n**CVSS risk score ([experimental](https://www.drupal.org/project/securitydrupalorg/issues/3442181)) 6.9 / Medium**\n\n[CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/acquia_dam"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.1.5"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.1.5"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<1.1.5"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2025-105"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Brandon Goodwin (bgoodie)",
47+
"contact": [
48+
"https://www.drupal.org/u/bgoodie"
49+
]
50+
},
51+
{
52+
"name": "Chris Burge (chris burge)",
53+
"contact": [
54+
"https://www.drupal.org/u/chris-burge"
55+
]
56+
},
57+
{
58+
"name": "Todd Woofenden (toddwoof)",
59+
"contact": [
60+
"https://www.drupal.org/u/toddwoof"
61+
]
62+
}
63+
]
64+
}

‎advisories/addtoany/DRUPAL-CONTRIB-2019-039.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2019-039",
4+
"modified": "2023-08-11T18:43:25.000Z",
5+
"published": "2019-03-20T13:26:14.000Z",
6+
"aliases": [],
7+
"details": "This module enables you to add social media share buttons on your website to its content and pages.\n\nThe module doesn't sufficiently mark its administration permission restricted, allowing cross site scripting vulnerabilities to users who have access to its admin settings.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"administer addtoany\".\n\n*This advisory was edited on March 25th to add the affected 8.x-1.11 release.*",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Packagist",
12+
"name": "drupal/addtoany"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.11.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.11.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.11.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2019-039"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Balazs Janos Tatar",
45+
"contact": [
46+
"https://www.drupal.org/user/649590"
47+
]
48+
}
49+
]
50+
}

0 commit comments

Comments
 (0)