Heine

The issue is related to a lack of authorization in the Drupal Entity Delete Log, which allows for forceful browsing. This can enable a remote attacker to bypass security restrictions and perform a forceful browsing attack.

The issue is related to a weak authentication vulnerability in the Two-factor Authentication (TFA) module for Drupal, which can be exploited to abuse authentication. This vulnerability is associated with weaknesses in the authentication procedure, allowing a remote attacker to bypass security restrictions.

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of privileged users, potentially leading to the execution of arbitrary PHP code.

The issue allows remote attackers to execute arbitrary SQL commands.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially leading to cross-site scripting (XSS) attacks.

The issue allows remote attackers to bypass upload validation and upload arbitrary files, possibly executing arbitrary code via unspecified vectors. This is due to the improper use of functions in the upload module.