Alex Bronstein

**Name of the Vulnerable Software and Affected Versions** Drupal Canvas versions 0.0.0 through 1.4.2 Drupal Canvas versions 1.5.0 through 1.5.2 Drupal Canvas versions 1.6.0 through 1.6.1 Drupal Canvas versions 1.7.0 through 1.7.1 **Description** An issue exists in the Canvas AI submodule where image files uploaded via a custom API for use in the AI web chat are insufficiently validated before being saved to the temporary directory. This improper neutralization of input during web page generation can lead to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Canvas versions prior to 1.0.4 **Description** The Drupal Canvas module has an authorization issue that allows forceful browsing of Canvas Pages when they are unpublished. The module does not adequately validate access to Canvas Pages, potentially allowing unauthorized access. This is mitigated by the fact that content moderation is not enabled by default and archiving is not a feature of the module. **Recommendations** Update to Drupal Canvas version 1.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 **Description** The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 8.0.0 through 10.3.13, update to version 10.3.14 or later. For versions 10.4.0 through 10.4.4, update to version 10.4.5 or later. For versions 11.0.0 through 11.0.12, update to version 11.0.13 or later. For versions 11.1.0 through 11.1.4, update to version 11.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 8.4.0 Drupal 7 versions prior to 7.57 **Description** A cross-site scripting issue is present in jQuery when making Ajax requests to untrusted domains. This issue requires contributed or custom modules to be exploitable. **Recommendations** For Drupal 8 versions prior to 8.4.0, update to Drupal 8.4.0 or later to resolve the issue. For Drupal 7 versions prior to 7.57, update to Drupal 7.57 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 6.x through 6.36 Drupal versions 7.x through 7.38 **Description** A cross-site scripting (XSS) issue in the Autocomplete system allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. **Recommendations** For Drupal 6.x, update to version 6.37 or later. For Drupal 7.x, update to version 7.39 or later. As a temporary workaround, consider restricting access to the file upload functionality until a patch is available.