Sascha Grossenbacher

**Name of the Vulnerable Software and Affected Versions** Entity API versions 0.0.0 through 1.8.0 **Description** An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module. **Recommendations** Update Entity API to a version later than 1.8.0. As a temporary mitigation, disable the JSON:API module to prevent the exploitation of the entity collection endpoints.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Browser versions 0.0.0 through 2.16.0 **Description** Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Entity Browser to a version later than 2.16.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs versions 0.0.0 through 1.21.0 **Description** A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module does not sufficiently restrict access to unpublished library items within lists. This occurs when the `paragraphs library` module is active and an attacker can access a list of library items, such as a view or a field providing autocomplete suggestions. **Recommendations** Update Drupal Paragraphs to a version later than 1.21.0. As a temporary mitigation, restrict access to the `paragraphs library` module or disable views and autocomplete fields that list library items.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs versions 0.0.0 through 1.21.0 **Description** A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module fails to sufficiently restrict access to direct child paragraphs of library items through API endpoints. This issue is mitigated if the `paragraphs library` module is not in use or if general write access to paragraphs via other modules is restricted. **Recommendations** Update Drupal Paragraphs to a version later than 1.21.0. As a temporary mitigation, disable the `paragraphs library` module.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Currency versions prior to 3.5.0 **Description** A Cross-Site Request Forgery (CSRF) issue exists in Drupal Currency. This allows attackers to perform actions on behalf of authenticated users without their knowledge. CSRF occurs when a malicious website, email, or other communication tricks a user's browser into sending a request to a vulnerable web application. **Recommendations** Update Drupal Currency to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** File Entity versions 7.X-* through 7.X-2.38 **Description** The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to bypass security restrictions and conduct Cross-Site Scripting attacks. **Recommendations** For versions 7.X-* through 7.X-2.38, update to a version newer than 7.X-2.38 to resolve the issue. As a temporary workaround, consider restricting access to the File Entity module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PEAR Structures-DataGrid-DataSource-MDB2 versions 0.1.9 and earlier **Description** The issue allows attackers to manipulate the generated sorting queries due to an unspecified vulnerability in the fetch function in MDB2.php. **Recommendations** For versions 0.1.9 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.