Dezső Biczó

**Name of the Vulnerable Software and Affected Versions** Drupal Single Content Sync versions 0.0.0 through 1.4.11 **Description** The issue is related to a Missing Authorization vulnerability in Drupal Single Content Sync, which allows functionality misuse. **Recommendations** For versions 0.0.0 through 1.4.11, update to version 1.4.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Profile Private version *.* **Description** The issue affects the private profile functionality. **Recommendations** For version *.*, consider updating to a newer version that addresses this issue, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions prior to the fixed version **Description** The form API in Drupal core has a vulnerability that affects certain contributed or custom modules' forms, making them susceptible to improper input validation. This could allow an attacker to inject disallowed values or overwrite data, potentially altering critical or sensitive data in uncommon but certain cases. **Recommendations** For versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to affected forms until a patch is available. Avoid using contributed or custom modules that may be vulnerable to improper input validation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Guzzle versions prior to 6.5.6 and 7.4.3 **Description** The issue is related to the cookie middleware in Guzzle, a PHP HTTP client. It does not check if the cookie domain equals the domain of the server that sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. This affects users who manually add the cookie middleware to the handler stack or construct the client with `['cookies' => true]`. Users who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected. **Recommendations** For versions prior to 6.5.6, upgrade to version 6.5.6. For versions prior to 7.4.3, upgrade to version 7.4.3. As a temporary workaround, consider turning off the cookie middleware.