From 3ac93fac497d0388a8a8d8b926f413912377d28f Mon Sep 17 00:00:00 2001 From: Tim Otten Date: Wed, 5 Jul 2017 18:55:20 -0700 Subject: [PATCH] release-notes/4.7.21 - Add section for security advisories --- release-notes/4.7.21.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/release-notes/4.7.21.md b/release-notes/4.7.21.md index 6ae72b6a54..5c94a13865 100644 --- a/release-notes/4.7.21.md +++ b/release-notes/4.7.21.md @@ -2,11 +2,24 @@ Released July 5, 2017 +- **[Security advisories](#security)** - **[Features](#features)** - **[Bugs resolved](#bugs)** - **[Miscellany](#misc)** - **[Credits](#credits)** +## Security advisories + +- **[CIVI-SA-2017-01](https://civicrm.org/advisory/civi-sa-2017-01-pingback-url-not-encrypted)** Pingback URL not encrypted +- **[CIVI-SA-2017-02](https://civicrm.org/advisory/civi-sa-2017-02-privilage-escalation-via-leaked-key)** Privilage escalation via leaked key +- **[CIVI-SA-2017-03](https://civicrm.org/advisory/civi-sa-2017-03-cross-site-scritping-in-the-recently-viewed-block)** Cross-site scripting in "Recently Viewed" block +- **[CIVI-SA-2017-04](https://civicrm.org/advisory/civi-sa-2017-04-incorrect-escaping-for-on-behalf-of-block)** Incorrect escaping for "On Behalf Of" block +- **[CIVI-SA-2017-05](https://civicrm.org/advisory/civi-sa-2017-05-incorrect-escaping-for-search-results-column)** Incorrect escaping for "Search Results" column +- **[CIVI-SA-2017-06](https://civicrm.org/advisory/civi-sa-2017-06-incorrect-escaping-in-drupal-views-integration)** Incorrect escaping in Drupal Views integration +- **[CIVI-SA-2017-07](https://civicrm.org/advisory/civi-sa-2017-07-insuffient-permission-check-in-mailing-report)** Insuffient permission-check in mailing report +- **[CIVI-SA-2017-08](https://civicrm.org/advisory/civi-sa-2017-08-upgrade-multiple-js-libraries)** Upgrade multiple JS libraries + + ## Features ### Core CiviCRM -- 2.25.1