Mingsong

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0 through 11.2.x **Description** Stored Cross-site Scripting (XSS) occurs because the Layout Builder module does not sufficiently sanitize block labels in certain scenarios. This allows an attacker to inject malicious scripts that are stored and later executed in the browser of another user. Exploitation requires both the attacker and the targeted user to be using the Layout Builder editing interface. **Recommendations** Update Drupal core versions 0.0.0 through 10.6.13 to a version newer than 10.6.13. Update Drupal core versions 11.3.0 through 11.3.14 to a version newer than 11.3.14. Update Drupal core versions 11.4.0 through 11.4.4 to a version newer than 11.4.4. Update Drupal core versions 0.0.0 through 11.0.x to a version newer than 11.0.x. Update Drupal core versions 0.0.0 through 11.1.x to a version newer than 11.1.x. Update Drupal core versions 0.0.0 through 11.2.x to a version newer than 11.2.x.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 11.3.0 through 11.3.6 **Description** Drupal core contains an issue where entity suggestions provided during the process of adding a link to CKEditor 5 are not sufficiently sanitized. This allows a malicious user to trigger a stored cross-site scripting (XSS) attack against other users. Cross-site scripting is a flaw where an application includes untrusted data in a web page without proper validation, allowing attackers to execute malicious scripts in the victim's browser. **Recommendations** Update to version 11.3.7.

**Name of the Vulnerable Software and Affected Versions** Drupal Tagify versions prior to 1.2.49 **Description** The Tagify module for Drupal does not properly sanitize user-provided input before using it in JavaScript templates within the Tagify widget. This allows for the execution of arbitrary JavaScript code in a user's browser when content is created or edited. The issue stems from insufficient input neutralization during web page generation, leading to a Cross-Site Scripting (XSS) condition. **Recommendations** Update Drupal Tagify to version 1.2.49 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 8.0.0 through 10.4.9 Drupal versions 10.5.0 through 10.5.6 Drupal versions 11.0.0 through 11.1.9 Drupal versions 11.2.0 through 11.2.8 **Description** A flaw exists in Drupal core that allows for content spoofing through a user interface misrepresentation of critical information. This issue impacts the display of content within the application. **Recommendations** Update Drupal core to version 10.4.9 or later. Update Drupal core to version 10.5.6 or later. Update Drupal core to version 11.1.9 or later. Update Drupal core to version 11.2.8 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 8.0.0 through 10.4.9 Drupal versions 10.5.0 through 10.5.6 Drupal versions 11.0.0 through 11.1.9 Drupal versions 11.2.0 through 11.2.8 **Description** A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels. **Recommendations** Update Drupal core to version 10.4.9 or later. Update Drupal core to version 10.5.6 or later. Update Drupal core to version 11.1.9 or later. Update Drupal core to version 11.2.8 or later.

**Name of the Vulnerable Software and Affected Versions** Events Log Track versions 0.0.0 through 3.1.10 Events Log Track versions 4.0.0 through 4.0.1 **Description** The issue is related to the allocation of resources without limits or throttling in Drupal Events Log Track, allowing excessive allocation. **Recommendations** For Events Log Track versions 0.0.0 through 3.1.10, update to version 3.1.11 or later. For Events Log Track versions 4.0.0 through 4.0.1, update to version 4.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 8.0.0 through 10.3.12 Drupal core versions 10.4.0 through 10.4.2 Drupal core versions 11.0.0 through 11.0.11 Drupal core versions 11.1.0 through 11.1.2 **Description** The issue is related to an Incorrect Authorization vulnerability in Drupal core, allowing Forceful Browsing. **Recommendations** For versions 8.0.0 through 10.3.12, update to version 10.3.13 or later. For versions 10.4.0 through 10.4.2, update to version 10.4.3 or later. For versions 11.0.0 through 11.0.11, update to version 11.0.12 or later. For versions 11.1.0 through 11.1.2, update to version 11.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.2 **Description** The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI (Artificial Intelligence). **Recommendations** For versions 0.0.0 through 1.0.2, update to version 1.0.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.8.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: The issue is related to insufficient protection of the web page structure, allowing an attacker to conduct a cross-site scripting (XSS) attack. This is due to improper neutralization of input during web page generation, which enables cross-site scripting. The problem affects Drupal Core, allowing attackers to exploit this flaw and leading to XSS. Recommendations: For Drupal Core versions 8.8.0 through 10.2.11, update to version 10.2.11 or later. For Drupal Core versions 10.3.0 through 10.3.9, update to version 10.3.9 or later. For Drupal Core versions 11.0.0 through 11.0.8, update to version 11.0.8 or later. As a temporary workaround, consider restricting the use of JavaScript to render status messages in certain cases and configurations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gutenberg versions 0.0.0 through 2.12.0 Gutenberg versions 3.0.0 through 3.0.4 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg, which allows for Cross-Site Request Forgery. This vulnerability can be exploited by a remote attacker to perform a CSRF attack. **Recommendations** For Gutenberg versions 0.0.0 through 2.12.0, update to version 2.13.0 or later. For Gutenberg versions 3.0.0 through 3.0.4, update to version 3.0.5 or later. As a temporary workaround, consider disabling the `Gutenberg` module until a patch is available. Restrict access to the `Gutenberg` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal Symfony Mailer Lite versions 0.0.0 through 1.0.6 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which can be exploited by a remote attacker to perform a CSRF attack. This vulnerability affects the Drupal Symfony Mailer Lite module, allowing an attacker to forge requests on a user's behalf. **Recommendations** For versions 0.0.0 through 1.0.6, update to version 1.0.6 or later to resolve the issue. As a temporary workaround, consider disabling the vulnerable module until a patch is available. Restrict access to the module to minimize the risk of exploitation.