Ryan Szrama

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 **Description** An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been. **Recommendations** Update Drupal Commerce CyberSource to a version later than 1.10.0.

**Name of the Vulnerable Software and Affected Versions** Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 **Description** An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment. **Recommendations** Update Commerce PayPal versions 0.0.0 through 1.12.0 to a version newer than 1.12.0. Update Commerce PayPal versions 2.0.0 through 2.1.3 to a version newer than 2.1.3.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Delete Log versions 0.0.0 through 1.1.1 **Description** The issue is related to a lack of authorization in the Drupal Entity Delete Log, which allows for forceful browsing. This can enable a remote attacker to bypass security restrictions and perform a forceful browsing attack. **Recommendations** For versions 0.0.0 through 1.1.1, update to a version that includes the fix for this issue to prevent forceful browsing attacks. As a temporary workaround, consider restricting access to the Entity Delete Log module until a patch is available.