Jã¼Rgen Haas

**Name of the Vulnerable Software and Affected Versions** Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 **Description** A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if the requester is an authorized signage device or if the requested block is intended for display. Consequently, an anonymous visitor can read the rendered content of blocks they are not authorized to see. This is partially mitigated if block plugins perform their own access checks on the content. **Recommendations** Update Drupal Digital Signage Framework to a version later than 2.6.1.

**Name of the Vulnerable Software and Affected Versions** ECA: Event - Condition - Action versions 0.0.0 through 2.1.20 ECA: Event - Condition - Action versions 3.0.0 through 3.0.12 ECA: Event - Condition - Action versions 3.1.0 through 3.1.4 **Description** Improperly controlled modification of dynamically-determined object attributes allows Object Injection. Additionally, the Render submodule fails to sufficiently sanitize template code when rendering inline Twig templates as part of no-code models, which can lead to information disclosure. This issue is mitigated if the site is not running an ECA model that utilizes the "Render: Twig" action on a data flow. **Recommendations** Update ECA: Event - Condition - Action to a version later than 2.1.20. Update ECA: Event - Condition - Action to a version later than 3.0.12. Update ECA: Event - Condition - Action to a version later than 3.1.4.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share versions prior to 3.13.0 **Description** An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources. **Recommendations** Update Drupal Entity Share to version 3.13.0 or later.