Julian Pustkuchen

An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

Stored Cross-site Scripting (XSS) occurs because user-entered text is used as part of a slide without appropriate filtering. This issue requires the attacker to possess a role with permissions to edit the caption.

An authorization flaw allows forceful browsing via a route used to display published content entities in a dialog. The system fails to sufficiently verify if the current user has access to the specific entity being requested. This issue is partially mitigated as field-level access controls remain active and only rendered output is returned.

Improperly controlled modification of dynamically-determined object attributes in the Block AJAX module allows for Object Injection. The module fails to sufficiently validate user-supplied data used to construct a block, which can lead to PHP Object Injection and Remote Code Execution. This issue specifically affects sites that have Layout Builder enabled or other block plugins that handle the data passed by this module in an unsafe manner.

An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a request mimics an XMLHttpRequest (a browser object used to interact with pages without reloading), which allows forceful browsing.

Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites.

A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting (XSS) attacks.

The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal SpamSpan filter. This allows for Cross-Site Scripting (XSS) attacks.