Ra Mänd

The module implements the `hook file download()` function to add a Content-Disposition header when a file URL contains the `download` query parameter. In Drupal 7, returning a non-empty header array from this hook grants access to the file. The module failed to perform access checks for files in the `temporary://` scheme or stream wrappers provided by other modules, only delegating to other `hook file download()` implementations for files in the private scheme. Consequently, an unauthenticated visitor can retrieve these files by appending `download=1` to the URL, bypassing intended access controls.

An improper authorization issue exists where users with the "edit field collections" permission can bypass access controls on the parent host entity. The `field collection item access()` function grants edit and delete access to any user with this permission without verifying if the user has the necessary access to the host entity, such as a node. This allows a user to modify or remove field collection items attached to an entity they are not authorized to edit.

Two stored Cross-Site Scripting (XSS) vectors exist in the widget/formatter rendering pipeline. The first vector occurs when the Token module is enabled and token display templates are configured, causing attacker-controlled token output, such as term descriptions, to be rendered without proper sanitization. This allows users capable of editing referenced taxonomy terms to inject HTML or JavaScript. The second vector involves taxonomy term labels that are not properly sanitized before being rendered in the widget, enabling users with permissions to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed.

Cross-site scripting risk exists due to improper output escaping of term-derived text. Malicious taxonomy term names can be rendered unsafely depending on the output context. Confirmed affected paths include the field formatter output `shs field formatter view()` and term-tree child-term data generation `shs term get children()`.

A flaw exists in Drupal Protected Pages that allows for excessive authentication attempts, potentially leading to brute force attacks. This issue impacts the Protected Pages module.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Description: The issue affects Drupal Core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This enables an attacker to conduct a cross-site scripting attack. Recommendations: For versions 7.0 through 7.101, update to version 7.102 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.