Shawn Duncan

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share Websub versions 0.0.0 through 1.1.2 **Description** Insufficient validation of certain inputs allows an attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources. **Recommendations** Update Drupal Entity Share Websub to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 0.0.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 **Description** Drupal core contains a cross-site scripting (XSS) issue due to improper neutralization of input during web page generation. The XSS filter does not sufficiently sanitize certain attributes from the integrated HTMX JavaScript library, allowing an attacker to execute malicious scripts if they can insert HTML with specific attributes. **Recommendations** Update Drupal core to a version later than 11.3.14. Update Drupal core to a version later than 11.4.4.

**Name of the Vulnerable Software and Affected Versions** Drupal OAuth2 Client versions 0.0.0 through 4.1.2 **Description** A Cross-Site Request Forgery (CSRF) issue affects the Drupal OAuth2 Client, allowing unauthorized actions to be performed on behalf of the user. This issue may be exploited by an attacker to perform actions without the user's knowledge or consent. **Recommendations** For Drupal OAuth2 Client versions 0.0.0 through 4.1.2, update to version 4.1.3 or later to resolve the issue.