Joseph Olstad

Name of the Vulnerable Software and Affected Versions: Drupal Paragraphs table versions 2.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal Paragraphs table. This allows for Cross-Site Scripting (XSS) attacks. Recommendations: For versions 2.0.0 through 2.0.4, update to version 2.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Bootstrap Site Alert versions 0.0.0 through 1.12.0 Drupal Bootstrap Site Alert versions 3.0.0 through 3.0.3 **Description** The issue affects Drupal Bootstrap Site Alert, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This enables attackers to inject malicious scripts into web pages. **Recommendations** For versions 0.0.0 through 1.12.0, update to version 1.13.0 or later. For versions 3.0.0 through 3.0.3, update to version 3.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** File Entity versions 7.X-* through 7.X-2.38 **Description** The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to bypass security restrictions and conduct Cross-Site Scripting attacks. **Recommendations** For versions 7.X-* through 7.X-2.38, update to a version newer than 7.X-2.38 to resolve the issue. As a temporary workaround, consider restricting access to the File Entity module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** File Entity versions 7.X-* before 7.X-2.39 **Description** The issue allows for the insertion of sensitive information into sent data, enabling forceful browsing. This can lead to the disclosure of protected information. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. Technical details about exploitation include the potential for an attacker to reveal sensitive information. **Recommendations** For versions 7.X-* before 7.X-2.39, update to version 7.X-2.39 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information in the File Entity module until a patch is applied. Avoid using the File Entity module for sensitive data transmission until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs table versions 0.0.0 through 1.22.0 Drupal Paragraphs table versions 2.0.0 through 2.0.1 **Description** The issue is related to insufficient granularity of access control in Drupal Paragraphs table, which allows content spoofing. This can be exploited by a remote attacker to bypass security restrictions and gain unauthorized access to protected information. **Recommendations** For Drupal Paragraphs table versions 0.0.0 through 1.22.0, update to version 1.23.0 or later. For Drupal Paragraphs table versions 2.0.0 through 2.0.1, update to version 2.0.2 or later.