Fabian Franz

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially lead to remote code execution if the application deserializes untrusted data due to another vulnerability. A gadget chain in Drupal core is exploitable when an insecure deserialization vulnerability exists, presenting a vector for remote code execution. The vulnerability is not directly exploitable and requires a separate vulnerability to allow an attacker to pass unsafe input to `unserialize()`. Recommendations: For versions 7.0 through 7.101, update to version 7.102 or later. For versions 8.0.0 through 10.2.10, update to version 10.2.11 or later. For versions 10.3.0 through 10.3.8, update to version 10.3.9 or later. As a temporary workaround, consider adding additional checks to the database code to help protect against this potential vulnerability. If using a third-party database driver, check the release notes for additional configuration steps that may be required in certain cases.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Description: The issue affects Drupal Core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This enables an attacker to conduct a cross-site scripting attack. Recommendations: For versions 7.0 through 7.101, update to version 7.102 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeNX versions prior to 0.2.8 **Description** The issue arises from improper handling of the XAUTHORITY environment variable when it is not set, allowing local users to access the X server without X authentication. **Recommendations** For versions prior to 0.2.8, update to version 0.2.8 or later to resolve the issue. As a temporary workaround, consider setting the XAUTHORITY environment variable to prevent unauthorized access to the X server.