Skip to content

Commit d084589

Browse files
G-RathG-Rath
committed
feat: regenerate advisories
1 parent 0f9e4bb commit d084589

939 files changed

Lines changed: 27287 additions & 27327 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/access_code/DRUPAL-CONTRIB-2025-028.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2025-028",
4+
"modified": "2025-04-02T17:02:32.000Z",
5+
"published": "2025-04-02T17:02:32.000Z",
6+
"aliases": [
7+
"CVE-2025-3129"
8+
],
9+
"details": "This module enables users to log in using a short access code instead of providing a username/password combination.\n\nThe module doesn't sufficiently protect against brute force attacks to guess a user's access code.\n\nThis vulnerability is mitigated by the fact that access code based logins are off by default and only enabled for accounts that enable it. Sites could mitigate the issue without updating by:\n\n1. disabling the access code login method for critical accounts\n2. monitor and prevent brute force attacks in other ways (for example, with a Web Application Firewall)",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Drupal",
14+
"name": "drupal/access_code"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.0.4"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.0.4"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.0.4"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2025-028"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Marcin Maruszewski (marcin maruszewski)",
47+
"contact": [
48+
"https://www.drupal.org/u/marcin-maruszewski"
49+
]
50+
}
51+
]
52+
}

‎advisories/access_code/DSA-CONTRIB-2025-028.json‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎advisories/acl/DRUPAL-CONTRIB-2023-034.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2023-034",
4+
"modified": "2023-08-23T18:45:47.000Z",
5+
"published": "2023-08-23T14:51:16.000Z",
6+
"aliases": [],
7+
"details": "The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.\n\nThe module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.\n\nAs this is an API module, it is only exploitable if a \"client\" module exposes the vulnerability. Details of some contributed client modules are given below. Custom modules using ACL could also expose the vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker typically needs an \"admin\"-type permission provided by one of ACL's client modules.\n\nKnown client modules include:\n\n* Forum Access\n* Flexi Access\n* Content Access\n\nCoordinated Security Advisories are being released for those client modules that have Security coverage.",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Drupal",
12+
"name": "drupal/acl"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.0.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.0.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.0.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2023-034"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Drew Webber",
45+
"contact": [
46+
"https://www.drupal.org/user/255969"
47+
]
48+
},
49+
{
50+
"name": "Samuel Mortenson",
51+
"contact": [
52+
"https://www.drupal.org/user/2582268"
53+
]
54+
}
55+
]
56+
}

‎advisories/acl/DSA-CONTRIB-2023-034.json‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

‎advisories/acquia_connector/DRUPAL-CONTRIB-2019-014.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2019-014",
4+
"modified": "2023-08-11T19:23:01.000Z",
5+
"published": "2019-02-06T18:13:19.000Z",
6+
"aliases": [],
7+
"details": "Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automates the collection of site information to speed support communication and issue resolution. It is required for use with the Acquia Insight service.\n\nThe module does not properly enforce access control in a specific case, which can lead to disclosing information.\n\nThe vulnerability is mitigated by requiring the module diff feature to be enabled. This feature is enabled by default.",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "Drupal",
12+
"name": "drupal/acquia_connector"
13+
},
14+
"severity": [],
15+
"ranges": [
16+
{
17+
"type": "ECOSYSTEM",
18+
"events": [
19+
{
20+
"introduced": "0"
21+
},
22+
{
23+
"fixed": "1.16.0"
24+
}
25+
],
26+
"database_specific": {
27+
"constraint": "<1.16.0"
28+
}
29+
}
30+
],
31+
"database_specific": {
32+
"affected_versions": "<1.16.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://www.drupal.org/sa-contrib-2019-014"
40+
}
41+
],
42+
"credits": [
43+
{
44+
"name": "Samuel Mortenson",
45+
"contact": [
46+
"https://www.drupal.org/user/2582268"
47+
]
48+
}
49+
]
50+
}

‎advisories/acquia_connector/DSA-CONTRIB-2019-014.json‎

Lines changed: 0 additions & 50 deletions
This file was deleted.

‎advisories/acquia_dam/DRUPAL-CONTRIB-2024-025.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2024-025",
4+
"modified": "2025-02-20T19:13:15.000Z",
5+
"published": "2024-06-05T16:45:02.000Z",
6+
"aliases": [
7+
"CVE-2024-13261"
8+
],
9+
"details": "Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance.\n\nThe module doesn't sufficiently protect the ability to disconnect a site from DAM. While disconnected sites do not lose asset data in Drupal, it will prevent site editors from accessing the DAM until a site administrator re-authenticates the site. Some uncached media images may also fail to be fetched while disconnected.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Drupal",
14+
"name": "drupal/acquia_dam"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.0.13"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.0.13"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "1.1.0-beta1"
37+
},
38+
{
39+
"fixed": "1.1.0-beta3"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=1.1.0-beta1 <1.1.0-beta3"
44+
}
45+
}
46+
],
47+
"database_specific": {
48+
"affected_versions": "<1.0.13 || >=1.1.0-beta1 <1.1.0-beta3",
49+
"patched": true
50+
}
51+
}
52+
],
53+
"references": [
54+
{
55+
"type": "WEB",
56+
"url": "https://www.drupal.org/sa-contrib-2024-025"
57+
}
58+
],
59+
"credits": [
60+
{
61+
"name": "Matt Glaman",
62+
"contact": [
63+
"https://www.drupal.org/user/2416470"
64+
]
65+
}
66+
]
67+
}

0 commit comments

Comments
 (0)