Heine Deelstra

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize user-supplied content before saving it to the public file system. This allows a maliciously crafted file to contain active or unsafe content that can be executed in the browser of other users.

An authentication bypass exists in the REST & JSON API Authentication for Drupal module. The module fails to sufficiently validate authentication requirements for all API requests, allowing an attacker to bypass the intended authentication layer.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

Improper verification of cryptographic signatures allows for signature spoofing. The module fails to properly restrict the signature algorithm used to validate a SAML assertion, enabling the algorithm to be influenced by the incoming response instead of being tied to the key type configured for the Identity Provider (IdP). An attacker must be able to submit a crafted SAML response to exploit this issue.

An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to sufficiently validate its CAPTCHA verification cookies, enabling an unauthenticated user or automated bot to forge the cookie and bypass the verification process entirely.

An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been.

A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer.

A security issue exists in the Drupal Screenshot project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer.

A security issue exists in the Drupal Screenshot project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer.

A security issue exists within the Drupal Link content parser.

A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer.

A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer.

An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL `EntityQuery` condition handler. The issue occurs when attacker-controlled PHP array keys, such as `filter[...][condition][value][malicious key]`, are concatenated directly into SQL identifiers without proper sanitization. This vulnerability exclusively affects sites using PostgreSQL databases. Remote anonymous users can exploit this to achieve full database access, exfiltrate sensitive data, escalate privileges to Administrator, and potentially execute arbitrary shell commands on the host server via Remote Code Execution (RCE) if database permissions are misconfigured (e.g., allowing `COPY FROM PROGRAM`). Over 15,000 attack probes against approximately 6,000 sites across 65 countries have been detected, with gaming and financial services being primary targets.

Name of the Vulnerable Software and Affected Versions: Drupal Config Pages versions 0.0.0 through 2.17.9 Description: Missing authorization allows forceful browsing of Config Pages. Recommendations: Update to version 2.18.0 or later.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in Drupal Ignition Error Pages. This allows for Cross-Site Scripting (XSS) attacks.

The issue is related to a 'Type Confusion' vulnerability, which allows an attacker to cause a denial of service via HTTP. This vulnerability can be exploited by a remote attacker.

The issue is related to insufficient control over interaction frequency in the Open Social module of the Drupal CMS system. This can be exploited by a remote attacker to cause a denial of service. The problem allows for misuse of functionality due to improper control of interaction frequency.

The issue is related to the insertion of sensitive information into sent data, which can allow forceful browsing. This can be exploited by a remote attacker to bypass security restrictions. The vulnerability is associated with insufficient protection of service data.

Name of the Vulnerable Software and Affected Versions: AES encryption project versions 7.x through 8.x Description: The AES encryption project for Drupal does not sufficiently prevent attackers from decrypting data. This issue is not covered by Drupal's security advisory policy. Recommendations: For versions 7.x through 8.x, update to a version that includes the necessary security patches to prevent data decryption by attackers.

The issue allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.