Derek Wright

**Name of the Vulnerable Software and Affected Versions** Drupal Quick Edit versions 0.0.0 through 1.0.4 Drupal Quick Edit versions 2.0.0 through 2.0.0 **Description** A flaw exists in Drupal Quick Edit that allows for Cross-Site Scripting (XSS). The issue stems from insufficient sanitization of certain image-related values during the editing process. An attacker must have permission to create or edit an affected field to exploit this. The vulnerability is related to improper neutralization of input during web page generation. **Recommendations** Update Drupal Quick Edit to version 1.0.5 or later. Update Drupal Quick Edit to version 2.0.1 or later.

**Nome do software vulnerável e versões afetadas** Versões do Drupal Core anteriores à 9.0.8 Versões do Drupal Core anteriores à 8.9.9 Versões do Drupal Core anteriores à 8.8.11 Versões do Drupal Core anteriores à 7.74 **Descrição** O problema está relacionado à sanitização inadequada de certos nomes de arquivos em arquivos enviados, o que pode levar a que os arquivos sejam interpretados com extensão incorreta e servidos com o tipo MIME errado ou executados como PHP em determinadas configurações de hospedagem. Isso pode permitir que um invasor remoto execute código PHP arbitrário no servidor. O número estimado de dispositivos potencialmente afetados em todo o mundo não foi especificado. **Recomendações** Para versões do Drupal Core anteriores à 9.0.8, atualize para a versão 9.0.8 ou posterior. Para versões do Drupal Core anteriores à 8.9.9, atualize para a versão 8.9.9 ou posterior. Para versões do Drupal Core anteriores à 8.8.11, atualize para a versão 8.8.11 ou posterior. Para versões do Drupal Core anteriores à 7.74, atualize para a versão 7.74 ou posterior. Como solução temporária, considere restringir o upload de arquivos para minimizar o risco de exploração. Evite usar a funcionalidade de upload de arquivos vulnerável até que o problema seja resolvido.

**Name of the Vulnerable Software and Affected Versions** Views Bulk Operations versions 5.x before 5.x-1.3 Views Bulk Operations versions 6.x before 6.x-1.4 **Description** A cross-site scripting issue exists in the theme views bulk operations confirmation function within the views bulk operations.module, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles. **Recommendations** For Views Bulk Operations versions 5.x before 5.x-1.3, update to version 5.x-1.3 or later. For Views Bulk Operations versions 6.x before 6.x-1.4, update to version 6.x-1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Project Issue Tracking module versions 5.x-2.x-dev before 20080130 Project Issue Tracking module versions 5.x-1.2 and earlier Project Issue Tracking module versions 4.7.x-2.6 and earlier Project Issue Tracking module versions 4.7.x-1.6 and earlier **Description** The issue allows remote attackers to upload and possibly execute arbitrary files due to a lack of restriction on the extensions of attached files when the Upload module is enabled for issue nodes. Additionally, it accepts the .html extension within the bundled file-upload functionality, allowing remote attackers to upload files containing arbitrary web script or HTML. **Recommendations** For versions 5.x-2.x-dev before 20080130, update to a version after 20080130 to restrict file extensions. For versions 5.x-1.2 and earlier, update to a version later than 5.x-1.2 to restrict file extensions. For versions 4.7.x-2.6 and earlier, update to a version later than 4.7.x-2.6 to restrict file extensions. For versions 4.7.x-1.6 and earlier, update to a version later than 4.7.x-1.6 to restrict file extensions. As a temporary workaround, consider disabling the Upload module for issue nodes until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Drupal Project Issue Tracking versions 4.7.x-1.0 through 4.7.x-2.0 Drupal Project versions 4.6.x-1.0, 4.7.x-1.0, 4.7.x-2.0 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via unspecified `parameters`. This is possible because the `check plain` function is not used. **Recommendations** For Drupal Project Issue Tracking versions 4.7.x-1.0 through 4.7.x-2.0, update to ensure the `check plain` function is utilized for all parameters. For Drupal Project versions 4.6.x-1.0, 4.7.x-1.0, 4.7.x-2.0, apply the same update to use the `check plain` function for parameters. As a temporary workaround, consider restricting access to unspecified parameters until a patch is available.