Ra Mã¤Nd

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize user-supplied content before saving it to the public file system. This allows a maliciously crafted file to contain active or unsafe content that can be executed in the browser of other users.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS) because the theme does not sufficiently filter certain attributes. This issue specifically affects the optional tooltip and popover features.

Drupal Shield fails to sufficiently limit the number of authentication attempts when an anonymous visitor repeatedly submits basic authentication credentials. This allows for brute force attacks against the HTTP basic authentication prompt used to protect non-public sites from being viewed, crawled, or indexed. The risk is reduced if long, randomly generated passwords are used.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default.

Reflected Cross-site Scripting (XSS) occurs when the module fails to sufficiently sanitize API response messages before rendering them in HTML output. Specifically, the ` cleantalk die()` and `ct die()` functions output the CleanTalk API response message directly into HTML, which allows the injection of arbitrary HTML or JavaScript. Exploitation requires the attacker to influence the CleanTalk cloud API response, such as through a man-in-the-middle attack or a compromised API server.

Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites.

Drupal core allows Object Injection due to improperly controlled modification of dynamically-determined object attributes. This issue involves a gadget chain—a sequence of existing code fragments—that can be leveraged to achieve remote code execution or SQL injection if the application deserializes untrusted data via the `unserialize()` function due to a separate vulnerability. This issue is not directly exploitable on its own.

The Drupal Material Icons module has an authorization issue. Insufficient permissions are added to dialog and autocomplete routes, potentially granting full access to these routes in many situations. This allows for forceful browsing. The module is designed to add icons to CKEditor.

A flaw exists in Drupal core that allows for content spoofing through a user interface misrepresentation of critical information. This issue impacts the display of content within the application.

Drupal core contains an improperly controlled modification of dynamically-determined object attributes, leading to Object Injection. This allows for potential manipulation of objects within the system.

An improper check for unusual or exceptional conditions exists in Drupal core, allowing for forceful browsing. This issue impacts the software's ability to handle unexpected input or situations, potentially leading to unauthorized access or information disclosure.

A flaw exists in Drupal Protected Pages that allows for excessive authentication attempts, potentially leading to brute force attacks. This issue impacts the Protected Pages module.