Stephen Mustgrave

An issue exists where the module does not sufficiently validate file URLs for malicious content during fallback retrieval. This leads to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the module to be enabled on the target site and the attacker to have the ability to upload a malicious file to the configured origin server.

Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. Files may be served with the `Cache-Control: public` HTTP header when they should be uncacheable, potentially allowing users to access cached versions of files containing information they are not authorized to see. This occurs when a more-privileged user has previously requested the file and it remains in the cache.

Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module enables direct viewing of files via URL aliases, but some files may be served with the `Cache-Control: public` HTTP header when they should be uncacheable. This allows users to access cached versions of files containing information they are not authorized to see. Exploitation requires an attacker to request a file previously accessed by a more-privileged user while that file remains in the cache.

Stored Cross-site Scripting (XSS) occurs because twig templates do not sufficiently sanitize values passed to its markup. This issue requires the attacker to possess a role that allows editing content using the paragraph bundles provided by the module.

Improperly controlled modification of dynamically-determined object attributes allows object injection. The module stores certain data as PHP-serialized strings, and if malicious data is written directly to the field, it can lead to object injection during the unserialization process. This issue requires the attacker to have permissions to edit a content entity with an attached `plotly js graph` field. Additionally, the core JSON:API module must be enabled with the option to accept all create, read, update, and delete operations, or the attacker must have an alternative method to edit field values directly.

The issue is related to the allocation of resources without limits or throttling in Drupal Events Log Track, allowing excessive allocation.

The issue is related to the allocation of resources without limits or throttling in Drupal Stage File Proxy, allowing flooding.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the baguetteBox.Js module for Drupal. This allows for Cross-Site Scripting (XSS) attacks.