Shelane French

**Name of the Vulnerable Software and Affected Versions** Drupal File Download versions 0.0.0 through 1.8.9 Drupal File Download versions 2.0.0 through 2.0.0 **Description** The File Download module is susceptible to a missing authorization issue, allowing for forceful browsing. **Recommendations** Update to a version prior to 1.9.0. Update to a version prior to 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Node Access Rebuild Progressive versions 7.X-1.0 through 7.X-1.2 **Description** The issue is related to improper ownership management in Node Access Rebuild Progressive, allowing target influence via framing. This can be exploited by a remote attacker to bypass security restrictions. **Recommendations** For versions 7.X-1.0 through 7.X-1.2, update to a version after 7.X-1.2 to resolve the issue. As a temporary workaround, consider restricting access to the Node Access Rebuild Progressive module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Node Access Rebuild Progressive versions 0.0.0 through 2.0.1 Node Access Rebuild Progressive version prior to 2.0.2 can be simplified to the above range, so it is omitted to avoid duplication. **Description** The issue is related to improper ownership management in the Node Access Rebuild Progressive module of the Drupal CMS system, which is associated with access control deficiencies. This can allow a remote attacker to bypass security restrictions. The vulnerability may enable an attacker to influence the target via framing. **Recommendations** For Node Access Rebuild Progressive versions 0.0.0 through 2.0.1, update to version 2.0.2 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures for this vulnerability.