Entity Api
Monthly
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3). Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3). Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.