Mohit Aghera

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0 through 11.2.x **Description** A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than `private://`. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images. **Recommendations** Update versions 0.0.0 through 10.6.13 to a newer version. Update versions 11.3.0 through 11.3.14 to a newer version. Update versions 11.4.0 through 11.4.4 to a newer version. Update versions 0.0.0 through 11.0.x to a newer version. Update versions 0.0.0 through 11.1.x to a newer version. Update versions 0.0.0 through 11.2.x to a newer version.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** Drupal core contains a gadget chain, which is a sequence of existing code fragments that can be leveraged during the deserialization of untrusted data. While this issue is not directly exploitable, it can serve as a vector to achieve remote code execution or SQL injection if a separate vulnerability allows an attacker to pass unsafe input to the `unserialize()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 8.0.0 through 10.4.9 Drupal versions 10.5.0 through 10.5.6 Drupal versions 11.0.0 through 11.1.9 Drupal versions 11.2.0 through 11.2.8 **Description** A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels. **Recommendations** Update Drupal core to version 10.4.9 or later. Update Drupal core to version 10.5.6 or later. Update Drupal core to version 11.1.9 or later. Update Drupal core to version 11.2.8 or later.