Bill Seremetis

**Name of the Vulnerable Software and Affected Versions** Drupal Advanced Content Feedback versions 0.0.0 through 2.8.0 **Description** Stored Cross-site Scripting (XSS) occurs when the module fails to sufficiently sanitize administrator-configured response messages. Specifically, the "Yes response", "No response", and custom text for "No" answers can contain HTML or script markup that is emitted as raw HTML to site visitors. Exploitation requires the attacker to possess a role with the "administer admin feedback" permission. **Recommendations** Update Drupal Advanced Content Feedback to a version later than 2.8.0. Restrict the "administer admin feedback" permission to only trusted users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal Advanced Content Feedback versions 0.0.0 through 2.8.0 **Description** An incorrect authorization issue in the Advanced Content Feedback module allows forceful browsing. The module fails to sufficiently verify authorization over the targeted feedback record during the processing of a comment submission. This issue can be exploited by users with the "give feedback" permission, which is granted to both anonymous and authenticated users by default upon installation. **Recommendations** Update Drupal Advanced Content Feedback to a version later than 2.8.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Realex / Global Payments versions 0.0.0 through 3.0.2 **Description** An incorrect authorization issue allows forceful browsing when the gateway is configured with the redirect payment method. The module fails to sufficiently verify the authenticity of the payment response returned by Global Payments. This specifically affects the redirect payment method, while the lightbox method, which validates the signature, remains unaffected. **Recommendations** Update Drupal Commerce Realex / Global Payments to a version later than 3.0.2. As a temporary mitigation, avoid using the redirect payment method and use the lightbox payment method instead.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Eurobank (Redirect) versions 0.0.0 through 2.1.0 **Description** The issue is related to an Incorrect Authorization vulnerability, allowing functionality misuse. **Recommendations** For versions 0.0.0 through 2.1.0, update to version 2.1.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Alphabank Redirect versions 0.0.0 through 1.0.2 **Description** The issue is related to an Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect, allowing functionality misuse. **Recommendations** For versions 0.0.0 through 1.0.2, update to version 1.0.3 or later to resolve the issue.