Joshua Sedler

An authorization flaw allows forceful browsing via a route used to display published content entities in a dialog. The system fails to sufficiently verify if the current user has access to the specific entity being requested. This issue is partially mitigated as field-level access controls remain active and only rendered output is returned.

Stored Cross-site Scripting (XSS) occurs because user-entered text is used as part of a slide without appropriate filtering. This issue requires the attacker to possess a role with permissions to edit the caption.

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize attributes applied to menu link container elements. This issue requires an attacker to possess the "Administer menus and menu links" and "Use menu link attributes" permissions. Additionally, an unsafe container attribute must have been previously configured by a user with the "Administer menu link attributes" permission. The default configuration is not affected.

Improperly controlled modification of dynamically-determined object attributes in the Block AJAX module allows for Object Injection. The module fails to sufficiently validate user-supplied data used to construct a block, which can lead to PHP Object Injection and Remote Code Execution. This issue specifically affects sites that have Layout Builder enabled or other block plugins that handle the data passed by this module in an unsafe manner.

An incorrect authorization issue in the entity merge functionality allows forceful browsing. The module does not sufficiently restrict access to entity management operations, enabling users with content viewing permissions to delete arbitrary nodes, taxonomy terms, or media entities.

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize user-supplied input, such as image alt tags, within its dynamic caption script. This allows an attacker with a role permitted to enter HTML content to execute malicious scripts. Cross-site Scripting is a flaw where malicious scripts are injected into trusted websites.

An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a request mimics an XMLHttpRequest (a browser object used to interact with pages without reloading), which allows forceful browsing.

A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted.

A functionality bypass exists in Drupal CAPTCHA due to insufficient invalidation of security tokens. An attacker may bypass the CAPTCHA on subsequent submissions if they first successfully solve at least one CAPTCHA manually to obtain valid tokens.

Name of the Vulnerable Software and Affected Versions: Drupal COOKiES Consent Management versions prior to 1.2.16 Description: A Cross-Site Scripting (XSS) issue exists in Drupal COOKiES Consent Management. This affects versions using the COOKiES Video submodule. Recommendations: Update to version 1.2.16.

The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal SpamSpan filter. This allows for Cross-Site Scripting (XSS) attacks.