Dor Tumarkin

The issue is related to a Cross-site Scripting (XSS) vulnerability in the ckeditor of Drupal Core, allowing an attacker to inject XSS. This vulnerability can be exploited by a remote attacker to perform cross-site scripting attacks.

The issue is related to insufficient authentication of executed requests in the Drupal CMS system. It can be exploited by a remote attacker to execute arbitrary code. Additionally, there is a Cross Site Request Forgery vulnerability in the Drupal Core Form API, which does not properly handle certain form input from cross-site requests, potentially leading to other vulnerabilities.

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP.