Bã¡Lint Nagy

An incorrect authorization issue allows forceful browsing when editing entities. The module fails to sufficiently verify access rights, enabling a malicious user to craft requests to modify any field on any entity. This issue is mitigated if the attacker lacks the "edit in place field editing permission" role.

An improper check for unusual or exceptional conditions in the Node View Permissions module allows forceful browsing. The module provides "View own content" and "View any content" permissions for each content type. The issue occurs when a user is cancelled and their content is reassigned to the anonymous user, as the module does not sufficiently handle this scenario. This affects private content that should not be accessible to anonymous users but was reassigned to them.

Name of the Vulnerable Software and Affected Versions: Drupal IFrame Remove Filter versions 0.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting attacks. Recommendations: For versions 0.0.0 through 2.0.4, update to version 2.0.5 or later to resolve the issue.