Klaus Purer

**Name of the Vulnerable Software and Affected Versions** Entity API versions 0.0.0 through 1.8.0 **Description** An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module. **Recommendations** Update Entity API to a version later than 1.8.0. As a temporary mitigation, disable the JSON:API module to prevent the exploitation of the entity collection endpoints.

**Name of the Vulnerable Software and Affected Versions** Drupal Coffee versions 0.0.0 through 1.4.0 **Description** The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can be exploited by a remote attacker to conduct a cross-site scripting attack. **Recommendations** For versions 0.0.0 through 1.4.0, update to a version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal (affected versions not specified) **Description** The issue concerns the JSON:API and REST/File modules in Drupal, which allow file uploads through their HTTP APIs. However, these modules do not correctly run all file validation, leading to an access bypass issue. An attacker could potentially upload files that bypass the validation process implemented by other modules on the site. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Scald module versions 6.x-1.x before 6.x-1.0-beta3 Scald module versions 7.x-1.x before 7.x-1.1 **Description** A cross-site scripting (XSS) issue exists in the Resource Manager of the MEE submodule in the Scald module for Drupal, allowing remote attackers to inject arbitrary web script or HTML via the `atom title`. **Recommendations** For Scald module version 6.x-1.x, update to version 6.x-1.0-beta3 or later. For Scald module version 7.x-1.x, update to version 7.x-1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 6.x-3.x through 7.x-3.x before 7.x-3.4 **Description** A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of victims via unknown vectors. **Recommendations** For versions 6.x-3.x through 7.x-3.x before 7.x-3.4, update to version 7.x-3.4 or later to resolve the issue.