Swan Kalata

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Entity PDF versions 0.0.0 through 2.1.5 **Description** Missing authorization in the Entity PDF module allows forceful browsing. The module fails to check entity view access when fetching a PDF route, which may allow a user to access a PDF of an entity they are not authorized to view. **Recommendations** Update Entity PDF to a version later than 2.1.5.

**Name of the Vulnerable Software and Affected Versions** Drupal Blazy versions 0.0.0 through 3.0.18 **Description** An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not consistently check entity view access, a user with access to a Blazy-enabled text format can render a field from an entity they are not permitted to view. This is limited to fields that the shortcode is capable of rendering. **Recommendations** Update Drupal Blazy to a version later than 3.0.18.

**Name of the Vulnerable Software and Affected Versions** Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 **Description** A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if the requester is an authorized signage device or if the requested block is intended for display. Consequently, an anonymous visitor can read the rendered content of blocks they are not authorized to see. This is partially mitigated if block plugins perform their own access checks on the content. **Recommendations** Update Drupal Digital Signage Framework to a version later than 2.6.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Address Suggestion versions 0.0.0 through 1.0.25 **Description** Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The Address Suggestion module, which provides address autocomplete functionality via configured providers, fails to sufficiently sanitize the data returned by these providers. Exploitation requires an attacker to inject malicious content into the data returned by a configured address provider and a user to perform a search that triggers the malicious suggestion. **Recommendations** Update Drupal Address Suggestion to a version later than 1.0.25.

**Name of the Vulnerable Software and Affected Versions** CAPTCHA Protected Page versions 0.0.0 through 1.0.2 **Description** An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to sufficiently validate its CAPTCHA verification cookies, enabling an unauthenticated user or automated bot to forge the cookie and bypass the verification process entirely. **Recommendations** Update CAPTCHA Protected Page to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Drupal LDAP / Active Directory Integration versions 0.0.0 through 2.2.1 **Description** An LDAP Injection issue exists because the module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover information that should not normally be accessible. **Recommendations** Update Drupal LDAP / Active Directory Integration to a version newer than 2.2.1.

**Name of the Vulnerable Software and Affected Versions** Entity API versions 0.0.0 through 1.8.0 **Description** An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module. **Recommendations** Update Entity API to a version later than 1.8.0. As a temporary mitigation, disable the JSON:API module to prevent the exploitation of the entity collection endpoints.

**Name of the Vulnerable Software and Affected Versions** Drupal Slick Carousel versions 0.0.0 through 2.1.0 **Description** Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting (XSS). The issue occurs because the module does not sufficiently validate user input within Slick option sets that contain HTML for carousel buttons. **Recommendations** Update Drupal Slick Carousel to version 8.x-2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Content Moderation Notifications versions 0.0.0 through 3.9.0 **Description** An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators. **Recommendations** Update Content Moderation Notifications to a version later than 3.9.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share Websub versions 0.0.0 through 1.1.2 **Description** Insufficient validation of certain inputs allows an attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources. **Recommendations** Update Drupal Entity Share Websub to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 **Description** An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment. **Recommendations** Update Commerce PayPal versions 0.0.0 through 1.12.0 to a version newer than 1.12.0. Update Commerce PayPal versions 2.0.0 through 2.1.3 to a version newer than 2.1.3.

**Name of the Vulnerable Software and Affected Versions** Drupal External Authentication versions 0.0.0 through 2.0.13 **Description** Improper handling of case sensitivity allows privilege escalation. The module fails to ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under specific database collation configurations. This issue primarily affects sites using certain MySQL or MariaDB collation settings for the authentication mapping storage. **Recommendations** Update Drupal External Authentication to a version newer than 2.0.13.

**Name of the Vulnerable Software and Affected Versions** Drupal Quick Tabs versions 0.0.0 through 4.3.1 **Description** An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants for node tabs and block plugins. Additionally, no access check is performed for reusable custom blocks. This allows users without proper permissions to view restricted content, such as unpublished nodes or unpublished reusable custom blocks. The risk is limited because the content exposed is pre-selected by a user with the `administer quicktabs` permission during configuration. **Recommendations** Update Drupal Quick Tabs to a version later than 4.3.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 **Description** An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This requires the attacker to possess a role with permission to view the entity. **Recommendations** Update Drupal Diff versions 0.0.0 through 2.0.1 to a fixed version. Update Drupal Diff versions 2.1.0 through 2.1.1 to a fixed version.

**Name of the Vulnerable Software and Affected Versions** Token Content Access versions 0.0.0 through 3.1.2 **Description** An observable timing discrepancy exists in the Token Content Access module, which allows site administrators to grant content access via access tokens. The module fails to sufficiently protect the comparison of access tokens, enabling a persistent attacker to perform a timing attack—a method of guessing secret data by measuring how long a system takes to respond—to discover a valid token and bypass access restrictions. Exploitation requires the attacker to know the URL of the protected content and accurately measure timing differences in the responses. **Recommendations** Update Token Content Access to a version later than 3.1.2.