Klaus Purer

An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module.

The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can be exploited by a remote attacker to conduct a cross-site scripting attack.

The issue concerns the JSON:API and REST/File modules in Drupal, which allow file uploads through their HTTP APIs. However, these modules do not correctly run all file validation, leading to an access bypass issue. An attacker could potentially upload files that bypass the validation process implemented by other modules on the site.

A cross-site scripting (XSS) issue exists in the Resource Manager of the MEE submodule in the Scald module for Drupal, allowing remote attackers to inject arbitrary web script or HTML via the `atom title`.

A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of victims via unknown vectors.