Frank Mably

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify which domains a user is assigned to when the per-content-type grant setting is enabled. This occurs when a user possesses a role with the permission to edit or delete any content on assigned domains, combined with a specific per-content-type permission, and is assigned to at least one domain.

Insufficient access control on taxonomy terms allows anonymous users to view any taxonomy terms on the site, including those that are unpublished or restricted. This is possible through the module's JSON endpoint.

A flaw exists in the Drupal Responsive Favicons module where administrator-entered text is not properly filtered, leading to a Cross-Site Scripting (XSS) issue. An attacker must possess the 'administer responsive favicons' permission to exploit this. The module adds favicons generated by `realfavicongenerator.net` to a Drupal site. The vulnerability is a type of Improper Neutralization of Input During Web Page Generation.

The AT Internet Piano Analytics module for Drupal contains a Cross-Site Scripting (XSS) issue. The module does not properly filter text entered by administrators, leading to a persistent XSS condition. An attacker must have the 'administer pianoanalytics' permission to exploit this.

The software contains a flaw due to improper neutralization of input during web page generation, which allows for Cross-Site Scripting (XSS). This means an attacker could potentially inject malicious scripts into web pages viewed by other users.

Name of the Vulnerable Software and Affected Versions: Toc.Js versions 0.0.0 through 3.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in Drupal Toc.Js. This allows an attacker to perform Cross-Site Scripting (XSS) attacks. Recommendations: For Toc.Js versions 0.0.0 through 3.2.1, update to version 3.2.1 or later to resolve the issue.

The issue is related to improper neutralization of input during web page generation, which allows for Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to perform inter-site script attacks.