Joseph Zhao

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 10.5.9 Drupal versions prior to 10.6.7 Drupal versions prior to 11.2.11 Drupal versions prior to 11.3.7 **Description** Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update to version 10.5.9 Update to version 10.6.7 Update to version 11.2.11 Update to version 11.3.7

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 **Description** The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 8.0.0 through 10.3.13, update to version 10.3.14 or later. For versions 10.4.0 through 10.4.4, update to version 10.4.5 or later. For versions 11.0.0 through 11.0.12, update to version 11.0.13 or later. For versions 11.1.0 through 11.1.4, update to version 11.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** RapiDoc OAS Field Formatter versions 0.0.0 through 1.0.0 **Description** The issue affects the RapiDoc OAS Field Formatter, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 0.0.0 through 1.0.0, update to version 1.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Formatter Suite versions 0.0.0 through 2.0.x **Description** The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can lead to the execution of malicious scripts on the client-side. **Recommendations** For versions 0.0.0 through 2.0.x, update to version 2.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Link field display mode formatter versions 0.0.0 through 1.6.0 **Description** The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal Link field display mode formatter. This allows for Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 1.6.0, update to version 1.6.0 or later to resolve the issue.