David Rothstein

Name of the Vulnerable Software and Affected Versions: Drupal Simple XML sitemap versions 0.0.0 through 4.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting attacks. Recommendations: For versions 0.0.0 through 4.2.1, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal REST & JSON API Authentication versions 0.0.0 through 2.0.12 **Description** The issue is related to an Incorrect Authorization vulnerability in Drupal REST & JSON API Authentication, allowing Forceful Browsing. This can enable a remote attacker to bypass existing security restrictions. **Recommendations** For versions 0.0.0 through 2.0.12, update to version 2.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST & JSON API Authentication module until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 8.4.0 Drupal 7 versions prior to 7.57 **Description** A cross-site scripting issue is present in jQuery when making Ajax requests to untrusted domains. This issue requires contributed or custom modules to be exploitable. **Recommendations** For Drupal 8 versions prior to 8.4.0, update to Drupal 8.4.0 or later to resolve the issue. For Drupal 7 versions prior to 7.57, update to Drupal 7.57 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions prior to 7.57 **Description** The issue allows an attacker to inject external links, potentially tricking users into navigating to unwanted sites when the language switcher block is used. Similar vulnerabilities exist in various custom and contributed modules. **Recommendations** For versions prior to 7.57, update to version 7.57 or later to resolve the issue. As a temporary workaround, consider disabling the language switcher block until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 7.38 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. **Recommendations** For versions prior to 7.38, update to version 7.38 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Webform module versions 5.x before 5.x-2.7 Drupal Webform module versions 6.x before 6.x-2.7 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a submission. **Recommendations** For versions 5.x before 5.x-2.7, update to version 5.x-2.7 or later. For versions 6.x before 6.x-2.7, update to version 6.x-2.7 or later.