Skip to content

Commit e6b8b9e

Browse files
github-actions[bot]G-Rath
github-actions[bot]
authored and
G-Rath
committed
feat: update advisories
1 parent 05401ee commit e6b8b9e

5 files changed

Lines changed: 314 additions & 0 deletions

File tree

‎advisories/atsmarttag/DRUPAL-CONTRIB-2026-003.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-003",
4+
"modified": "2026-01-14T17:55:41.000Z",
5+
"published": "2026-01-14T17:55:41.000Z",
6+
"aliases": [
7+
"CVE-2026-0946"
8+
],
9+
"details": "This module integrates the AT Internet SmartTag service.\n\nThe module does not filter administrator-entered text leading to a persistent Cross-site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"administer atsmarttag\".",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/atsmarttag"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.0.1"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.0.1"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<1.0.1"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-003"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Pierre Rudloff (prudloff)",
47+
"contact": [
48+
"https://www.drupal.org/u/prudloff"
49+
]
50+
}
51+
]
52+
}

‎advisories/ginvite/DRUPAL-CONTRIB-2026-001.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-001",
4+
"modified": "2026-01-14T17:53:33.000Z",
5+
"published": "2026-01-14T17:53:33.000Z",
6+
"aliases": [
7+
"CVE-2026-0944"
8+
],
9+
"details": "This module enables allows group managers to invite people into their group.\n\nThe module doesn't sufficiently check access under certain circumstances, allowing unauthorized users to access the group's content.\n\nThis vulnerability is mitigated by the fact that it only occurs when certain uncommon actions are taken by a user with the permission to create group invites.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/ginvite"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.3.9"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.3.9"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "3.0.0"
37+
},
38+
{
39+
"fixed": "3.0.4"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=3.0.0 <3.0.4"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "4.0.0"
51+
},
52+
{
53+
"fixed": "4.0.4"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=4.0.0 <4.0.4"
58+
}
59+
}
60+
],
61+
"database_specific": {
62+
"affected_versions": "<2.3.9 || >=3.0.0 <3.0.4 || >=4.0.0 <4.0.4"
63+
}
64+
}
65+
],
66+
"references": [
67+
{
68+
"type": "WEB",
69+
"url": "https://www.drupal.org/sa-contrib-2026-001"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "Kevin Quillen (kevinquillen)",
75+
"contact": [
76+
"https://www.drupal.org/u/kevinquillen"
77+
]
78+
}
79+
]
80+
}

‎advisories/pianoanalytics/DRUPAL-CONTRIB-2026-004.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-004",
4+
"modified": "2026-01-14T17:56:28.000Z",
5+
"published": "2026-01-14T17:56:28.000Z",
6+
"aliases": [
7+
"CVE-2026-0947"
8+
],
9+
"details": "This module integrates the AT Internet Piano Analytics service.\n\nThe module does not filter administrator-entered text leading to a persistent Cross-site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"administer pianoanalytics\".",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/pianoanalytics"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.0.1"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.0.1"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "2.0.0"
37+
},
38+
{
39+
"fixed": "2.3.1"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=2.0.0 <2.3.1"
44+
}
45+
}
46+
],
47+
"database_specific": {
48+
"affected_versions": "<1.0.1 || >=2.0.0 <2.3.1"
49+
}
50+
}
51+
],
52+
"references": [
53+
{
54+
"type": "WEB",
55+
"url": "https://www.drupal.org/sa-contrib-2026-004"
56+
}
57+
],
58+
"credits": [
59+
{
60+
"name": "Pierre Rudloff (prudloff)",
61+
"contact": [
62+
"https://www.drupal.org/u/prudloff"
63+
]
64+
}
65+
]
66+
}

‎advisories/role_delegation/DRUPAL-CONTRIB-2026-002.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-002",
4+
"modified": "2026-01-14T17:54:33.000Z",
5+
"published": "2026-01-14T17:54:33.000Z",
6+
"aliases": [
7+
"CVE-2026-0945"
8+
],
9+
"details": "This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the \"administer permissions\" permission.\n\nThe module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user with the ability to delegate a role is also able to assign the administrator role, including to their own user.\n\nThis vulnerability is mitigated by the fact that an attacker must have access to a view of users with the Views Bulk Operations module enabled.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/role_delegation"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "1.3.0"
23+
},
24+
{
25+
"fixed": "1.5.0"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": ">=1.3.0 <1.5.0"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": ">=1.3.0 <1.5.0"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-002"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Drew Webber (mcdruid)",
47+
"contact": [
48+
"https://www.drupal.org/u/mcdruid"
49+
]
50+
}
51+
]
52+
}

‎advisories/social_auth_entra_id/DRUPAL-CONTRIB-2026-005.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-005",
4+
"modified": "2026-01-14T17:57:31.000Z",
5+
"published": "2026-01-14T17:57:31.000Z",
6+
"aliases": [
7+
"CVE-2026-0948"
8+
],
9+
"details": "This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0.\n\nThe module doesn't sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/social_auth_entra_id"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.0.4"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.0.4"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<1.0.4"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-005"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Ashish Verma (ashish.verma85)",
47+
"contact": [
48+
"https://www.drupal.org/u/ashishverma85"
49+
]
50+
},
51+
{
52+
"name": "Dheeraj Jhamtani (dheeraj jhamtani)",
53+
"contact": [
54+
"https://www.drupal.org/u/dheeraj-jhamtani"
55+
]
56+
},
57+
{
58+
"name": "Marcelo Vani (marcelovani)",
59+
"contact": [
60+
"https://www.drupal.org/u/marcelovani"
61+
]
62+
}
63+
]
64+
}

0 commit comments

Comments
 (0)