Bram Driesen

**Name of the Vulnerable Software and Affected Versions** Token Content Access versions 0.0.0 through 3.1.2 **Description** An observable timing discrepancy exists in the Token Content Access module, which allows site administrators to grant content access via access tokens. The module fails to sufficiently protect the comparison of access tokens, enabling a persistent attacker to perform a timing attack—a method of guessing secret data by measuring how long a system takes to respond—to discover a valid token and bypass access restrictions. Exploitation requires the attacker to know the URL of the protected content and accurately measure timing differences in the responses. **Recommendations** Update Token Content Access to a version later than 3.1.2.

**Name of the Vulnerable Software and Affected Versions** Drupal Internationalization Single Sign-On versions 0.0.0 through 1.8.0 **Description** An authentication bypass exists in the Drupal Internationalization Single Sign-On module. The module fails to sufficiently validate a short-lived token, which allows an attacker to bypass access control and authenticate as a victim user. This issue occurs in multilingual website scenarios where different domain names are used per language to enable automatic connection across domains. Exploitation requires the attacker to appear to originate from the same client IP address as the victim. **Recommendations** Update Drupal Internationalization Single Sign-On to a version later than 1.8.0.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module and specific submodules, including AI Automators, AI Translate, AI API Explorer, and AI Content Suggestions, enable the use of a Large Language Model (LLM) to generate HTML or Markdown for browser preview. Under certain conditions, rendering this HTML can lead to XSS or the exposure of secret communications within the context of the LLM request. This issue requires an attacker to be able to inject text into prompts to execute the attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users. **Recommendations** Update Drupal AI versions 0.0.0 through 1.2.17 to a version newer than 1.2.17. Update Drupal AI versions 1.3.0 through 1.3.8 to a version newer than 1.3.8. Update Drupal AI versions 1.4.0 through 1.4.3 to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** Drupal AI Agents versions 0.0.0 through 1.1.4 Drupal AI Agents versions 1.2.0 through 1.2.5 Drupal AI Agents versions 1.3.0 through 1.3.1 **Description** An incorrect authorization issue allows forceful browsing. Under certain conditions, the agent inherits deterministic parameters when invoking the same tool within a single request, which may result in information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tealium iQ Tag Management versions 0.0.0 through 2.4.0 **Description** Improperly controlled modification of dynamically-determined object attributes in the Tealium iQ Tag Management module allows for Object Injection. This occurs because the `tealiumiq` field stores data as PHP-serialized strings; if malicious data is written to this field, it can be executed when the data is unserialized. Exploitation requires the attacker to have permissions to edit a content entity with an attached `tealiumiq` field. Additionally, the core `jsonapi` module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly. **Recommendations** Update Tealium iQ Tag Management to a version later than 2.4.0. Restrict permissions to edit content entities containing the `tealiumiq` field. Disable the "Accept all JSON:API create, read, update, and delete operations" option in the `jsonapi` module.

**Name of the Vulnerable Software and Affected Versions** Drupal OpenAI Provider versions 0.0.0 through 1.1.1 Drupal OpenAI Provider versions 1.2.0 through 1.2.2 **Description** Insufficient sanitization of user-supplied URLs leads to a Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. Exploitation requires the attacker to have permissions to modify the host URL and the ability to generate AI-generated images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI Agents versions 0.0.0 through 1.1.4 Drupal AI Agents versions 1.2.0 through 1.2.5 Drupal AI Agents versions 1.3.0 through 1.3.1 **Description** Missing authorization allows forceful browsing within the module that provides the entity type and runtime for agents to use tools. The issue occurs because the module does not sufficiently check required permissions when a tool loads content entities. Exploitation requires that an agent be configured to use the affected tool and that the attacker has access to that agent. **Recommendations** Update Drupal AI Agents versions 0.0.0 through 1.1.4 to a version newer than 1.1.4. Update Drupal AI Agents versions 1.2.0 through 1.2.5 to a version newer than 1.2.5. Update Drupal AI Agents versions 1.3.0 through 1.3.1 to a version newer than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Colorbox Inline versions 0.0.0 through 2.1.0 **Description** An issue in the Drupal Colorbox Inline module, which allows opening page content within a colorbox, occurs because the module does not sufficiently sanitize the `data-colorbox-inline` attribute value before passing it to jQuery. This leads to Cross-Site Scripting (XSS), a flaw where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permissions to enter HTML tags containing specific data attributes. **Recommendations** Update to version 2.1.1.

**Name of the Vulnerable Software and Affected Versions** Drupal AJAX Dashboard versions prior to 3.1.0 **Description** A missing authentication check for a critical function in Drupal AJAX Dashboard allows exploitation of incorrectly configured access control security levels. The issue resides in the AJAX Dashboard module, specifically related to entity dashboards enabling configurable dashboards attached to entities with AJAX-reloading capabilities. The module does not adequately verify access permissions on the dashboard configuration route, potentially allowing unauthorized users to access and modify dashboard settings. The vulnerability is mitigated if the AJAX Dashboard Entity Dashboard submodule is not enabled. **Recommendations** Update to AJAX Dashboard version 3.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Next.Js versions 0.0.0 through 1.6.3 Next.Js versions 2.0.0 through 2.0.0 **Description** A security issue exists in Next.Js related to a permissive cross-domain security policy with untrusted domains, which can lead to Cross-Site Scripting (XSS). This allows for potential malicious code execution within the context of a user's browser. **Recommendations** Update Next.Js to version 1.6.4 or later. Update Next.Js to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.0.6 Drupal AI versions 1.1.0 through 1.1.6 Drupal AI versions 1.2.0 through 1.2.3 **Description** A flaw exists in Drupal AI that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Drupal AI to version 1.0.7 or later. Update Drupal AI to version 1.1.7 or later. Update Drupal AI to version 1.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Tagify versions prior to 1.2.44 **Description** A flaw exists in Drupal Tagify that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow attackers to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Drupal Tagify to version 1.2.44 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share versions prior to 3.13.0 **Description** An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources. **Recommendations** Update Drupal Entity Share to version 3.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Bookable Calendar versions 0.0.0 through 2.2.12 **Description** The issue is related to a Missing Authorization vulnerability in Drupal Bookable Calendar, which allows Forceful Browsing. **Recommendations** For versions 0.0.0 through 2.2.12, update to version 2.2.13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 **Description** The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 8.0.0 through 10.3.13, update to version 10.3.14 or later. For versions 10.4.0 through 10.4.4, update to version 10.4.5 or later. For versions 11.0.0 through 11.0.12, update to version 11.0.13 or later. For versions 11.1.0 through 11.1.4, update to version 11.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Formatter Suite versions 0.0.0 through 2.0.x **Description** The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can lead to the execution of malicious scripts on the client-side. **Recommendations** For versions 0.0.0 through 2.0.x, update to version 2.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** RapiDoc OAS Field Formatter versions 0.0.0 through 1.0.0 **Description** The issue affects the RapiDoc OAS Field Formatter, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 0.0.0 through 1.0.0, update to version 1.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Link field display mode formatter versions 0.0.0 through 1.6.0 **Description** The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal Link field display mode formatter. This allows for Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 1.6.0, update to version 1.6.0 or later to resolve the issue.