João Ventura

The issue is related to a weak authentication vulnerability in the Two-factor Authentication (TFA) module for Drupal, which can be exploited to abuse authentication. This vulnerability is associated with weaknesses in the authentication procedure, allowing a remote attacker to bypass security restrictions.

A cross-site scripting (XSS) issue exists in the Send by e-mail module, allowing remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail.