David Rothstein

Name of the Vulnerable Software and Affected Versions: Drupal Simple XML sitemap versions 0.0.0 through 4.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting attacks. Recommendations: For versions 0.0.0 through 4.2.1, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

The issue is related to an Incorrect Authorization vulnerability in Drupal REST & JSON API Authentication, allowing Forceful Browsing. This can enable a remote attacker to bypass existing security restrictions.

A cross-site scripting issue is present in jQuery when making Ajax requests to untrusted domains. This issue requires contributed or custom modules to be exploitable.

The issue allows an attacker to inject external links, potentially tricking users into navigating to unwanted sites when the language switcher block is used. Similar vulnerabilities exist in various custom and contributed modules.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a submission.