Bram Driesen

**Name of the Vulnerable Software and Affected Versions** Drupal Colorbox Inline versions 0.0.0 through 2.1.0 **Description** An issue in the Drupal Colorbox Inline module, which allows opening page content within a colorbox, occurs because the module does not sufficiently sanitize the `data-colorbox-inline` attribute value before passing it to jQuery. This leads to Cross-Site Scripting (XSS), a flaw where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permissions to enter HTML tags containing specific data attributes. **Recommendations** Update to version 2.1.1.

**Name of the Vulnerable Software and Affected Versions** Drupal AJAX Dashboard versions prior to 3.1.0 **Description** A missing authentication check for a critical function in Drupal AJAX Dashboard allows exploitation of incorrectly configured access control security levels. The issue resides in the AJAX Dashboard module, specifically related to entity dashboards enabling configurable dashboards attached to entities with AJAX-reloading capabilities. The module does not adequately verify access permissions on the dashboard configuration route, potentially allowing unauthorized users to access and modify dashboard settings. The vulnerability is mitigated if the AJAX Dashboard Entity Dashboard submodule is not enabled. **Recommendations** Update to AJAX Dashboard version 3.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share versions prior to 3.13.0 **Description** An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources. **Recommendations** Update Drupal Entity Share to version 3.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.0.6 Drupal AI versions 1.1.0 through 1.1.6 Drupal AI versions 1.2.0 through 1.2.3 **Description** A flaw exists in Drupal AI that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Drupal AI to version 1.0.7 or later. Update Drupal AI to version 1.1.7 or later. Update Drupal AI to version 1.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Tagify versions prior to 1.2.44 **Description** A flaw exists in Drupal Tagify that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow attackers to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Drupal Tagify to version 1.2.44 or later.

**Name of the Vulnerable Software and Affected Versions** Next.Js versions 0.0.0 through 1.6.3 Next.Js versions 2.0.0 through 2.0.0 **Description** A security issue exists in Next.Js related to a permissive cross-domain security policy with untrusted domains, which can lead to Cross-Site Scripting (XSS). This allows for potential malicious code execution within the context of a user's browser. **Recommendations** Update Next.Js to version 1.6.4 or later. Update Next.Js to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Bookable Calendar versions 0.0.0 through 2.2.12 **Description** The issue is related to a Missing Authorization vulnerability in Drupal Bookable Calendar, which allows Forceful Browsing. **Recommendations** For versions 0.0.0 through 2.2.12, update to version 2.2.13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 **Description** The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 8.0.0 through 10.3.13, update to version 10.3.14 or later. For versions 10.4.0 through 10.4.4, update to version 10.4.5 or later. For versions 11.0.0 through 11.0.12, update to version 11.0.13 or later. For versions 11.1.0 through 11.1.4, update to version 11.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Formatter Suite versions 0.0.0 through 2.0.x **Description** The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can lead to the execution of malicious scripts on the client-side. **Recommendations** For versions 0.0.0 through 2.0.x, update to version 2.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** RapiDoc OAS Field Formatter versions 0.0.0 through 1.0.0 **Description** The issue affects the RapiDoc OAS Field Formatter, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 0.0.0 through 1.0.0, update to version 1.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Link field display mode formatter versions 0.0.0 through 1.6.0 **Description** The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal Link field display mode formatter. This allows for Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 1.6.0, update to version 1.6.0 or later to resolve the issue.