Bohdan Artemchuk

**Name of the Vulnerable Software and Affected Versions** Drupal Siteimprove Analytics versions 0.0.0 through 2.0.1 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code. Exploitation requires the attacker to possess a role with the `administer siteimprove analytics` permission. **Recommendations** Update Drupal Siteimprove Analytics to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Reverse Proxy Header versions prior to 1.1.2 **Description** An improper validation of consistency within input exists in Drupal Reverse Proxy Header, allowing manipulation of user-controlled variables. **Recommendations** Update to version 1.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Mailjet versions 0.0.0 through 4.0.0 **Description** The issue is related to the deserialization mechanism in the Mailjet module of the Drupal CMS system. It allows for the deserialization of untrusted data, leading to object injection. This can enable a remote attacker to execute arbitrary code. **Recommendations** For versions 0.0.0 through 4.0.0, update to version 4.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the deserialization mechanism in the Mailjet module until a patch is available. Restrict access to the Mailjet module to minimize the risk of exploitation.