Mingsong

An incorrect authorization issue allows forceful browsing and an access bypass. This allows an attacker to update entity fields without the system verifying field-level access. This action requires the attacker to already possess permissions to update the entity itself.

Incorrectly configured access control security levels allow the caching of token permissions in a manner that enables them to be reused for another user's token sharing the same scopes. This can lead to a user gaining unauthorized permissions, including administrative access. Exploitation requires a more privileged user's token with identical scopes to be used first.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

Stored Cross-site Scripting (XSS) occurs because the Layout Builder module does not sufficiently sanitize block labels in certain scenarios. This allows an attacker to inject malicious scripts that are stored and later executed in the browser of another user. Exploitation requires both the attacker and the targeted user to be using the Layout Builder editing interface.

Drupal core contains an issue where entity suggestions provided during the process of adding a link to CKEditor 5 are not sufficiently sanitized. This allows a malicious user to trigger a stored cross-site scripting (XSS) attack against other users. Cross-site scripting is a flaw where an application includes untrusted data in a web page without proper validation, allowing attackers to execute malicious scripts in the victim's browser.

The Tagify module for Drupal does not properly sanitize user-provided input before using it in JavaScript templates within the Tagify widget. This allows for the execution of arbitrary JavaScript code in a user's browser when content is created or edited. The issue stems from insufficient input neutralization during web page generation, leading to a Cross-Site Scripting (XSS) condition.

A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels.

A flaw exists in Drupal core that allows for content spoofing through a user interface misrepresentation of critical information. This issue impacts the display of content within the application.

The issue is related to the allocation of resources without limits or throttling in Drupal Events Log Track, allowing excessive allocation.

The issue is related to an Incorrect Authorization vulnerability in Drupal core, allowing Forceful Browsing.

The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI (Artificial Intelligence).

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.8.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: The issue is related to insufficient protection of the web page structure, allowing an attacker to conduct a cross-site scripting (XSS) attack. This is due to improper neutralization of input during web page generation, which enables cross-site scripting. The problem affects Drupal Core, allowing attackers to exploit this flaw and leading to XSS. Recommendations: For Drupal Core versions 8.8.0 through 10.2.11, update to version 10.2.11 or later. For Drupal Core versions 10.3.0 through 10.3.9, update to version 10.3.9 or later. For Drupal Core versions 11.0.0 through 11.0.8, update to version 11.0.8 or later. As a temporary workaround, consider restricting the use of JavaScript to render status messages in certain cases and configurations to minimize the risk of exploitation.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg, which allows for Cross-Site Request Forgery. This vulnerability can be exploited by a remote attacker to perform a CSRF attack.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which can be exploited by a remote attacker to perform a CSRF attack. This vulnerability affects the Drupal Symfony Mailer Lite module, allowing an attacker to forge requests on a user's behalf.