Adam Bramley

**Name of the Vulnerable Software and Affected Versions** Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 **Description** An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This requires the attacker to possess a role with permission to view the entity. **Recommendations** Update Drupal Diff versions 0.0.0 through 2.0.1 to a fixed version. Update Drupal Diff versions 2.1.0 through 2.1.1 to a fixed version.

**Name of the Vulnerable Software and Affected Versions** Drupal Role Delegation versions 1.3.0 through 1.4.9 **Description** A privilege escalation issue exists in the Role Delegation module. The module allows site administrators to grant specific roles the authority to assign selected roles to users, without needing the 'administer permissions' permission. A vulnerability allows a user with the ability to delegate a role to also assign the administrator role, even to their own user account. This is possible when the module is used with the Views Bulk Operations module and an attacker has access to a view of users with the Views Bulk Operations module enabled. **Recommendations** Update to Role Delegation version 1.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal CivicTheme Design System versions prior to 1.12.0 **Description** A flaw exists in the CivicTheme Design System that allows for Cross-Site Scripting (XSS). This occurs due to improper neutralization of input during web page generation. The issue impacts the way user-supplied data is handled, potentially allowing attackers to inject malicious scripts into web pages viewed by other users. **Recommendations** Update to CivicTheme Design System version 1.12.0 or later.

**Name of the Vulnerable Software and Affected Versions** Diff versions 0.0.0 through 1.8.0 **Description** The issue is related to an incorrect authorization vulnerability in the Diff module of the Drupal content management system. This vulnerability allows for functionality misuse. A remote attacker may exploit this issue to gain access to confidential information. **Recommendations** For versions 0.0.0 through 1.8.0, update to version 1.8.0 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.