Alexander Varwijk

Incorrectly configured access control security levels allow the caching of token permissions in a manner that enables them to be reused for another user's token sharing the same scopes. This can lead to a user gaining unauthorized permissions, including administrative access. Exploitation requires a more privileged user's token with identical scopes to be used first.

The Real-time SEO for Drupal module contains a flaw due to improper neutralization of input during web page generation, which allows for Cross-Site Scripting (XSS).

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.3.13 Open Social versions 12.4.0 through 12.4.12 Description: A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited to perform actions without the user's knowledge or consent. Recommendations: For Open Social versions 0.0.0 through 12.3.13, update to version 12.3.14 or later. For Open Social versions 12.4.0 through 12.4.12, update to version 12.4.13 or later.