Julian Pustkuchen

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Browser versions 0.0.0 through 2.16.0 **Description** Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Entity Browser to a version later than 2.16.0.

**Name of the Vulnerable Software and Affected Versions** PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 3.2.0 **Description** A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted. **Recommendations** Update PhotoSwipe - Responsive JavaScript Modal Image Gallery to version 3.0.4 or later for Drupal 8. Update PhotoSwipe - Responsive JavaScript Modal Image Gallery to version 3.2.0 or later for Drupal 9 and Drupal 10.

**Name of the Vulnerable Software and Affected Versions** COOKiES Consent Management versions 0.0.0 through 1.2.14 **Description** The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 0.0.0 through 1.2.14, update to version 1.2.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal etracker versions 0.0.0 through 3.0.x **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 3.0.x, update to version 3.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal SpamSpan filter versions 0.0.0 through 3.2.0 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal SpamSpan filter. This allows for Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 3.2.0, update to version 3.2.1 or later to resolve the issue.