Affected: Packagist:https://packages.drupal.org/8: drupal/permissions_by_term

The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxonomy terms.

The module grants access to nodes that are being blocked by other node access modules and that the Permissions by Term module does not intend to control. Additionally, it grants access to unpublished nodes in node listings to users who should not be able to see them. These problems lead to an access bypass vulnerability.

This vulnerability is mitigated by the fact that it only occurs on sites that either have another node access module (besides Permissions by Term) in use, or that have node listings that are accessible to unprivileged users and that don't directly filter out unpublished content.

Affected: Packagist:https://packages.drupal.org/8: drupal/config_perms

Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form.

When this module is in use, any user who is able to perform an action which rebuilds some of Drupal's caches can trigger a scenario in which certain pages protected by this module's custom permissions temporarily lose those custom access controls, thereby leading to an access bypass vulnerability.

Affected: Packagist:https://packages.drupal.org/8: drupal/config_update

The Configuration Update Reports sub-module in the Configuration Update module project enables you to run reports to see what configuration on your site differs from the configuration distributed by a module, theme, or installation profile, and to revert, delete, or import configuration.

This module doesn't sufficiently protect the Import operation, thereby exposing a Cross Site Request Forgery (CSRF) vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted import of configuration.

This vulnerability is mitigated by the fact that only configuration items distributed with a module, theme, or installation profile that is currently installed and enabled on the site can be imported, not arbitrary configuration values.

Affected: Packagist:https://packages.drupal.org/8: drupal/link_click_count

The Link Click Count module helps you to monitor the traffic to your website by creating link fields. These link fields can be individual links or internal/external links that can be added to the content type.

The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. The security team takes action in cases like this without regard to the severity of the security issue in question. If you would like to maintain this module, please read: <https://www.drupal.org/node/251466>

All projects that are being marked unsupported are given a score of critical. Code that is no longer maintained poses a threat to securing sites.

Affected: Packagist:https://packages.drupal.org/8: drupal/stacks

This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets.

The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class.

This vulnerability is mitigated by the fact that only sites with the Stacks - Content Feed submodule enabled are affected.

Affected: Packagist:https://packages.drupal.org/8: drupal/node_view_permissions

The Node view permissions module enables the "View own content" and "View any content" permissions for each content type on the permissions page.

This module has a vulnerability that allows users with these permissions to view unpublished content that they are not otherwise authorized to view.

**This issue was fixed by the maintainer outside of the normal security team protocols. Some issues were patched in 2014 for the 7.x version of this module. The 8.x release was updated within the last 6 months. Both are now flagged as security updates.**

Affected: Packagist:https://packages.drupal.org/8: drupal/entity_ref_tab_formatter

This module enables you to show referenced entities in tabs.

The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content of the content type that is referenced.

Affected: Packagist:https://packages.drupal.org/8: drupal/ckeditor_uploadimage

This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server.

Affected: Packagist:https://packages.drupal.org/8: drupal/jsonapi

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities.

* The module doesn't sufficiently associate cacheability metadata in certain situations thereby causing an access bypass vulnerability.

This vulnerability is mitigated by the fact that an attacker cannot trigger an exploitable situation themselves. * The module doesn't sufficiently check access in certain situations.

This vulnerability is mitigated by the fact that an attacker must have permission to create entities of certain content entity types.

#### Update: This is fixed in 8.x-1.10 not 8.x-1.9

Affected: Packagist:https://packages.drupal.org/8: drupal/jsonapi

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities.

The module doesn't sufficiently check access when viewing related resources or relationships, thereby causing an access bypass vulnerability.

This vulnerability is mitigated by the fact that an attacker must be allowed to view the related data, otherwise all they can glean is an entity type UUID and a UUID, which are meaningless by themselves.