Dan Smith

Insufficient access restrictions on the delete form allow forceful browsing, which occurs when a user accesses a page or resource without proper authorization. This issue allows unauthorized users to delete webform submissions in bulk using a specified date range.

The Tagify module for Drupal does not properly sanitize user-provided input before using it in JavaScript templates within the Tagify widget. This allows for the execution of arbitrary JavaScript code in a user's browser when content is created or edited. The issue stems from insufficient input neutralization during web page generation, leading to a Cross-Site Scripting (XSS) condition.

A flaw in the interaction between OpenStack Nova and the `qemu-img` utility allows an authenticated user to overwrite arbitrary files or destroy data on the compute host. The issue occurs when Nova's Flat image backend invokes `qemu-img` without strictly constraining the disk image format. An attacker can exploit this by writing a malicious QCOW header to a root or ephemeral disk and triggering a resize operation. This vulnerability specifically affects compute nodes using the Flat image backend, typically those configured with `use cow images` set to `False`.

Name of the Vulnerable Software and Affected Versions: Drupal Authenticator Login versions 0.0.0 through 2.1.3 Description: An Authentication Bypass Using an Alternate Path or Channel issue exists in Drupal Authenticator Login, allowing for Authentication Bypass. Recommendations: Update to version 2.1.4 or later.

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication (TFA) versions 0.0.0 through 1.10.0 Description: The issue affects the two-factor authentication (TFA) mechanism, allowing exploitation of incorrectly configured access control security levels due to a privilege defined with unsafe actions. Recommendations: For versions 0.0.0 through 1.10.0, update to version 1.11.0 or later to resolve the issue.

The issue concerns a vulnerability in image processing, where a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, potentially leading to unauthorized access to sensitive data.

The issue is related to a Cross-Site Scripting (XSS) vulnerability via data injection when using the Pulse web application to view Region entries.