Nguyen Bao

**Name of the Vulnerable Software and Affected Versions** Drupal Address Suggestion versions 0.0.0 through 1.0.25 **Description** Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The Address Suggestion module, which provides address autocomplete functionality via configured providers, fails to sufficiently sanitize the data returned by these providers. Exploitation requires an attacker to inject malicious content into the data returned by a configured address provider and a user to perform a search that triggers the malicious suggestion. **Recommendations** Update Drupal Address Suggestion to a version later than 1.0.25.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Drupal Paragraphs table versions 2.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal Paragraphs table. This allows for Cross-Site Scripting (XSS) attacks. Recommendations: For versions 2.0.0 through 2.0.4, update to version 2.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs table versions 0.0.0 through 1.22.0 Drupal Paragraphs table versions 2.0.0 through 2.0.1 **Description** The issue is related to insufficient granularity of access control in Drupal Paragraphs table, which allows content spoofing. This can be exploited by a remote attacker to bypass security restrictions and gain unauthorized access to protected information. **Recommendations** For Drupal Paragraphs table versions 0.0.0 through 1.22.0, update to version 1.23.0 or later. For Drupal Paragraphs table versions 2.0.0 through 2.0.1, update to version 2.0.2 or later.