Joseph Olstad

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize user-supplied content before saving it to the public file system. This allows a maliciously crafted file to contain active or unsafe content that can be executed in the browser of other users.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS) because the theme does not sufficiently filter certain attributes. This issue specifically affects the optional tooltip and popover features.

Stored Cross-site Scripting (XSS) occurs when the `file uri` formatter fails to properly escape filenames when rendering links to uploaded files. This allows an attacker with permissions to upload files into a Data Field file subfield to inject malicious scripts into the web page. Cross-site Scripting is a flaw where untrusted data is inserted into a web page without proper validation or encoding, allowing the execution of scripts in the victim's browser.

Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize node titles when displaying the orphaned nodes report. This allows an attacker with permissions to create content of a type configured for the orphaned nodes report to inject malicious scripts. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The Address Suggestion module, which provides address autocomplete functionality via configured providers, fails to sufficiently sanitize the data returned by these providers. Exploitation requires an attacker to inject malicious content into the data returned by a configured address provider and a user to perform a search that triggers the malicious suggestion.

Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content.

Name of the Vulnerable Software and Affected Versions: Drupal Paragraphs table versions 2.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal Paragraphs table. This allows for Cross-Site Scripting (XSS) attacks. Recommendations: For versions 2.0.0 through 2.0.4, update to version 2.0.5 or later to resolve the issue.

The issue affects Drupal Bootstrap Site Alert, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This enables attackers to inject malicious scripts into web pages.

The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to bypass security restrictions and conduct Cross-Site Scripting attacks.

The issue allows for the insertion of sensitive information into sent data, enabling forceful browsing. This can lead to the disclosure of protected information. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. Technical details about exploitation include the potential for an attacker to reveal sensitive information.

The issue is related to insufficient granularity of access control in Drupal Paragraphs table, which allows content spoofing. This can be exploited by a remote attacker to bypass security restrictions and gain unauthorized access to protected information.