Derek Wright

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This requires the attacker to possess a role with permission to view the entity.

يوجد عيب في Drupal Quick Edit يتيح تنفيذ هجمات البرمجة النصية عبر المواقع (XSS). تنبع المشكلة من عدم كفاية تنقية بعض القيم المتعلقة بالصور أثناء عملية التحرير. يجب أن يكون لدى المهاجم إذن لإنشاء أو تحرير حقل متأثر لاستغلال هذه الثغرة. ترتبط هذه الثغرة بعدم معالجة المدخلات بشكل صحيح أثناء إنشاء صفحة الويب.

The issue is related to the improper sanitization of certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This can allow a remote attacker to execute arbitrary PHP code on the server. The estimated number of potentially affected devices worldwide is not specified.

A cross-site scripting issue exists in the theme views bulk operations confirmation function within the views bulk operations.module, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles.

The issue allows remote attackers to upload and possibly execute arbitrary files due to a lack of restriction on the extensions of attached files when the Upload module is enabled for issue nodes. Additionally, it accepts the .html extension within the bundled file-upload functionality, allowing remote attackers to upload files containing arbitrary web script or HTML.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified `parameters`. This is possible because the `check plain` function is not used.