Joshua Sedler

**Name of the Vulnerable Software and Affected Versions** PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 3.2.0 **Description** A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted. **Recommendations** Update PhotoSwipe - Responsive JavaScript Modal Image Gallery to version 3.0.4 or later for Drupal 8. Update PhotoSwipe - Responsive JavaScript Modal Image Gallery to version 3.2.0 or later for Drupal 9 and Drupal 10.

**Name of the Vulnerable Software and Affected Versions** Drupal CAPTCHA versions 0.0.0 through 1.16.9 Drupal CAPTCHA versions 2.0.0 through 2.0.9 **Description** A functionality bypass exists in Drupal CAPTCHA due to insufficient invalidation of security tokens. An attacker may bypass the CAPTCHA on subsequent submissions if they first successfully solve at least one CAPTCHA manually to obtain valid tokens. **Recommendations** Update Drupal CAPTCHA to version 1.17.0 or later. Update Drupal CAPTCHA to version 2.0.10 or later.

Name of the Vulnerable Software and Affected Versions: Drupal COOKiES Consent Management versions prior to 1.2.16 Description: A Cross-Site Scripting (XSS) issue exists in Drupal COOKiES Consent Management. This affects versions using the COOKiES Video submodule. Recommendations: Update to version 1.2.16.

**Name of the Vulnerable Software and Affected Versions** COOKiES Consent Management versions 0.0.0 through 1.2.14 **Description** The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 0.0.0 through 1.2.14, update to version 1.2.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal SpamSpan filter versions 0.0.0 through 3.2.0 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal SpamSpan filter. This allows for Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 3.2.0, update to version 3.2.1 or later to resolve the issue.