Wayne Eaker

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: A vulnerability in Drupal Core allows privilege escalation. This issue is related to inconsistencies in uniqueness checking for certain user fields, depending on the database engine and its collation, which may lead to data integrity issues. Recommendations: For Drupal Core versions 8.0.0 through 10.2.11, update to a version after 10.2.11. For Drupal Core versions 10.3.0 through 10.3.9, update to a version after 10.3.9. For Drupal Core versions 11.0.0 through 11.0.8, update to a version after 11.0.8.

**Name of the Vulnerable Software and Affected Versions** Drupal Symfony Mailer Lite versions 0.0.0 through 1.0.6 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which can be exploited by a remote attacker to perform a CSRF attack. This vulnerability affects the Drupal Symfony Mailer Lite module, allowing an attacker to forge requests on a user's behalf. **Recommendations** For versions 0.0.0 through 1.0.6, update to version 1.0.6 or later to resolve the issue. As a temporary workaround, consider disabling the vulnerable module until a patch is available. Restrict access to the module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal Swift Mailer versions *.* **Description** The issue is related to an Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer, which allows Resource Location Spoofing. This can be exploited by a remote attacker to perform spoofing attacks. **Recommendations** For Drupal Swift Mailer versions *.*: At the moment, there is no information about a newer version that contains a fix for this vulnerability.