Tag1 D7ES Announcements

The Notify module renders node titles, comment subjects, and subscriber email addresses in its admin forms without HTML-encoding, allowing an authenticated user to inject arbitrary JavaScript that executes in an administrator's browser.

The performance-report download and report-generation menu routes are configured with an access callback that unconditionally grants access to every user, silently voiding the permissions those routes were meant to require and allowing an anonymous user to download stored performance-profiling reports.

The BOTCHA Spam Prevention module fails to sanitize the recipe book title before output, both as the page title on the recipe book edit page and in the recipe book listing, allowing a user who can configure BOTCHA to inject arbitrary HTML/JavaScript that executes when either page is viewed.

The BOTCHA module shipped a hardcoded, publicly-known default secret that was used as a fallback on sites where `botcha_secret` had never been set. Because BOTCHA's per-form tokens are derived from this secret, an attacker who knows the value can compute valid challenge responses and bypass bot protection on any affected form. Only sites installed before August 2013 are affected. `hook_install()` has generated a random site-unique secret since that date, so any installation or reinstallation since then is not vulnerable.

The Simple Package Tracking module exposes four AJAX endpoints for deleting and triggering actions on order tracking numbers, but guarded them only with `user_access('access content')`. Any authenticated user could delete or re-trigger tracking actions on tracking numbers belonging to orders they do not own.

The Mass Contact module fails to sanitize attachment filenames before inserting them into error messages, allowing an attacker with send permissions to inject arbitrary HTML or JavaScript by uploading a file with a crafted filename.

The Mass Contact module passed an empty validators array when saving email attachments to the server, allowing authenticated users to upload files of any type and size. Uploaded files are stored in a publicly accessible directory, which may expose the server to stored malicious content.

The Helper module's XML parsing API accepted user-controlled URLs without validating whether the target address was an internal or reserved network resource, allowing authenticated attackers to make the server issue requests to private infrastructure.

The Node Form Settings module failed to HTML-escape the node title when inserting it into custom form page titles, allowing a user with content creation permissions to inject arbitrary HTML into the edit and delete node form pages viewed by other users.

The Adaptive Image module passes the unvalidated `$style` argument to internal processing code before checking its validity, causing PHP warnings that expose server filesystem paths when an invalid image style is requested. Invalid requests also receive an HTTP 200 OK response instead of 404.