Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed. This advisory is not covered by Drupal Steward...

Drupal 8.9.x < 8.9.19 / 9.1.x < 9.1.13 / 9.2.x < 9.2.6 Multiple Vulnerabilities (drupal-2021-09-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.19, 9.1.x prior to 9.1.13, or 9.2.x prior to 9.2.6. It is, therefore, affected by multiple vulnerabilities. - Under some circumstances, the Drupal core JSON:API module does not...

Cross-Site Scripting (XSS)

Drupal is susceptible to cross-site scripting XSS attacks. The attacks are possible because the entityLabel and fieldLabel parameters are not properly encoded. When an admin goes to edit the node using quickedit module, the entered script will execute...

QuickEdit Text Editor - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application QuickEdit Text Editor published at the 'play' market has multiple vulnerabilities...