Sascha Grossenbacher

An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module.

Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites.

A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module does not sufficiently restrict access to unpublished library items within lists. This occurs when the `paragraphs library` module is active and an attacker can access a list of library items, such as a view or a field providing autocomplete suggestions.

A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module fails to sufficiently restrict access to direct child paragraphs of library items through API endpoints. This issue is mitigated if the `paragraphs library` module is not in use or if general write access to paragraphs via other modules is restricted.

An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default.

A Cross-Site Request Forgery (CSRF) issue exists in Drupal Currency. This allows attackers to perform actions on behalf of authenticated users without their knowledge. CSRF occurs when a malicious website, email, or other communication tricks a user's browser into sending a request to a vulnerable web application.

The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to bypass security restrictions and conduct Cross-Site Scripting attacks.

The issue allows attackers to manipulate the generated sorting queries due to an unspecified vulnerability in the fetch function in MDB2.php.