Skip to content

Commit a714dd3

Browse files
G-RathG-Rath
authored
feat: switch to DRUPAL prefix (#143)
This is the prefix we're going with per ossf/osv-schema#372
1 parent 5348e53 commit a714dd3

989 files changed

Lines changed: 28575 additions & 28614 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/access_code/DRUPAL-CONTRIB-2025-028.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2025-028",
4+
"modified": "2025-04-02T17:02:32.000Z",
5+
"published": "2025-04-02T17:02:32.000Z",
6+
"aliases": [
7+
"CVE-2025-3129"
8+
],
9+
"details": "This module enables users to log in using a short access code instead of providing a username/password combination.\n\nThe module doesn't sufficiently protect against brute force attacks to guess a user's access code.\n\nThis vulnerability is mitigated by the fact that access code based logins are off by default and only enabled for accounts that enable it. Sites could mitigate the issue without updating by:\n\n1. disabling the access code login method for critical accounts\n2. monitor and prevent brute force attacks in other ways (for example, with a Web Application Firewall)",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/access_code"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.0.4"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.0.4"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.0.4"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2025-028"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Marcin Maruszewski (marcin maruszewski)",
47+
"contact": [
48+
"https://www.drupal.org/u/marcin-maruszewski"
49+
]
50+
}
51+
]
52+
}

‎advisories/access_code/DRUPAL-CONTRIB-2025-108.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2025-108",
4+
"modified": "2025-09-24T17:27:20.000Z",
5+
"published": "2025-09-24T17:27:20.000Z",
6+
"aliases": [
7+
"CVE-2025-10928"
8+
],
9+
"details": "This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the \"change own access code\" permission.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist",
14+
"name": "drupal/access_code"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.0.5"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.0.5"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.0.5"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2025-108"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

‎advisories/access_code/DSA-CONTRIB-2025-028.json‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎advisories/access_code/DSA-CONTRIB-2025-108.json‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎advisories/acl/DRUPAL-CONTRIB-2023-034.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2023-034",
4+
"modified": "2023-08-23T18:45:47.000Z",
5+
"published": "2023-08-23T14:51:16.000Z",
6+
"aliases": [],
7+
"details": "The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.\n\nThe module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.\n\nAs this is an API module, it is only exploitable if a \"client\" module exposes the vulnerability. Details of some contributed client modules are given below. Custom modules using ACL could also expose the vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker typically needs an \"admin\"-type permission provided by one of ACL's client modules.\n\nKnown client modules include:\n\n* Forum Access\n* Flexi Access\n* Content Access\n\nCoordinated Security Advisories are being released for those client modules that have Security coverage.",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Packagist",
12+
"name": "drupal/acl"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.0.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.0.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.0.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2023-034"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Drew Webber",
45+
"contact": [
46+
"https://www.drupal.org/user/255969"
47+
]
48+
},
49+
{
50+
"name": "Samuel Mortenson",
51+
"contact": [
52+
"https://www.drupal.org/user/2582268"
53+
]
54+
}
55+
]
56+
}

‎advisories/acl/DSA-CONTRIB-2023-034.json‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

‎advisories/acquia_connector/DRUPAL-CONTRIB-2019-014.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2019-014",
4+
"modified": "2023-08-11T19:23:01.000Z",
5+
"published": "2019-02-06T18:13:19.000Z",
6+
"aliases": [],
7+
"details": "Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automates the collection of site information to speed support communication and issue resolution. It is required for use with the Acquia Insight service.\n\nThe module does not properly enforce access control in a specific case, which can lead to disclosing information.\n\nThe vulnerability is mitigated by requiring the module diff feature to be enabled. This feature is enabled by default.",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Packagist",
12+
"name": "drupal/acquia_connector"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.16.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.16.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.16.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2019-014"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Samuel Mortenson",
45+
"contact": [
46+
"https://www.drupal.org/user/2582268"
47+
]
48+
}
49+
]
50+
}

0 commit comments

Comments
 (0)