Cross Site Request Forgery vulnerability in Aggregator
module
CVE: CVE-2012-0826
An XSRF vulnerability can force an aggregator feed to update.
Since some services are rate-limited (e.g. Twitter limits
requests to 150 per hour) this could lead to a denial of
service.
This issue affects Drupal 6.x and 7.x.
OpenID not verifying signed attributes in SREG and AX
CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some
OpenID relying parties implement Attribute Exchange (AX). Not
verifying that attributes being passed through AX have been
signed could allow an attacker to modify users' information.
This issue affects Drupal 6.x and 7.x.
Access bypass in File module
CVE: CVE-2012-0827
When using private files in combination with certain field
access modules, the File module will allow users to download
the file even if they do not have access to view the field it
was attached to.
This issue affects Drupal 7.x only.