James Gilliland

An authentication bypass issue exists where the module fails to fully invalidate a solved CAPTCHA session. This allows a protected form that has been submitted once to be submitted again without solving a new challenge. This flaw weakens protection against automated submissions, including login brute-forcing, comment spam, and spam registrations.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

Stored Cross-site Scripting (XSS) occurs because the Layout Builder module does not sufficiently sanitize block labels in certain scenarios. This allows an attacker to inject malicious scripts that are stored and later executed in the browser of another user. Exploitation requires both the attacker and the targeted user to be using the Layout Builder editing interface.

The `rebuild.php` front controller, used to clear caches and rebuild the container when a site is in an unexpected condition, fails to correctly validate the Host header against trusted host patterns. This flaw can lead to cache poisoning, where a cache is filled with a malicious response, or an open redirect, which sends users to an attacker-controlled domain.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.

Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites.

A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in Drupal Ignition Error Pages. This allows for Cross-Site Scripting (XSS) attacks.