Ivan

**Nome do Software Vulnerável e Versões Afetadas** Versões do Drupal JSON Field anteriores à 1.5 **Descrição** Existe uma falha no Drupal JSON Field que permite Cross-Site Scripting (XSS). Este problema deve-se à neutralização inadequada de entrada durante a geração da página web. A exploração bem-sucedida pode permitir que um atacante injete scripts maliciosos em páginas web visualizadas por outros usuários. **Recomendações** Atualize o Drupal JSON Field para a versão 1.5 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 8.4.x before 8.4.5 **Description** The issue allows users with permission to post comments to view content and comments they do not have access to, and also to add comments to this content. This is mitigated by the requirement that the comment system must be enabled and the attacker must have permission to post comments. **Recommendations** For Drupal versions 8.4.x before 8.4.5, update to version 8.4.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** alchemist.vim (affected versions not specified) **Description** The issue concerns remote code execution in the alchemist-server bundled with Elixir's vim plugin, alchemist.vim. A malicious website can execute requests against an ephemeral port on localhost, which are then evaluated as Elixir code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.