Alex Bronstein

**Name of the Vulnerable Software and Affected Versions** Drupal Canvas versions prior to 1.0.4 **Description** The Drupal Canvas module has an authorization issue that allows forceful browsing of Canvas Pages when they are unpublished. The module does not adequately validate access to Canvas Pages, potentially allowing unauthorized access. This is mitigated by the fact that content moderation is not enabled by default and archiving is not a feature of the module. **Recommendations** Update to Drupal Canvas version 1.0.4 or later.

**Nome do Software Vulnerável e Versões Afetadas** Versões do Drupal core 8.0.0 até 10.3.13 Versões do Drupal core 10.4.0 até 10.4.4 Versões do Drupal core 11.0.0 até 11.0.12 Versões do Drupal core 11.1.0 até 11.1.4 **Descrição** O problema afeta o Drupal core, permitindo Cross-Site Scripting (XSS) devido à neutralização inadequada de entrada durante a geração de páginas web. **Recomendações** Para as versões 8.0.0 até 10.3.13, atualize para a versão 10.3.14 ou posterior. Para as versões 10.4.0 até 10.4.4, atualize para a versão 10.4.5 ou posterior. Para as versões 11.0.0 até 11.0.12, atualize para a versão 11.0.13 ou posterior. Para as versões 11.1.0 até 11.1.4, atualize para a versão 11.1.5 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 8.4.0 Drupal 7 versions prior to 7.57 **Description** A cross-site scripting issue is present in jQuery when making Ajax requests to untrusted domains. This issue requires contributed or custom modules to be exploitable. **Recommendations** For Drupal 8 versions prior to 8.4.0, update to Drupal 8.4.0 or later to resolve the issue. For Drupal 7 versions prior to 7.57, update to Drupal 7.57 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 6.x through 6.36 Drupal versions 7.x through 7.38 **Description** A cross-site scripting (XSS) issue in the Autocomplete system allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. **Recommendations** For Drupal 6.x, update to version 6.37 or later. For Drupal 7.x, update to version 7.39 or later. As a temporary workaround, consider restricting access to the file upload functionality until a patch is available.