deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8w5f-8992-g86j
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-cjm6-8mw8-2f8c
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Improper Authorization vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-8m2r-x2m2-3wmw
Package: pimcore/pimcore (COMPOSER)
Severity: MODERATE (CVSS 2.4)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 11.4.2, < 11.5.3
Patched in: unpatched

Summary: Duplicate Advisory: Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document

Details:
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xr3m-6gq6-22cg. This link is maintained to preserve external references.

Original Description
A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
GitHub Security Advisory: GHSA-qv78-c8hc-438r
Package: openmage/magento-lts (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 20.16.0
Patched in: 20.16.0

Summary: OpenMage vulnerable to XSS in Admin Notifications

Details:
### Summary
OpenMage versions v20.15.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

### Details
Unescaped translation strings and URLs are printed into contexts inside `app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php`. A malicious translation or polluted data can inject script. 
- Link labels use __() without escaping.
- ’deleteConfirm()’ embeds a message without escaping.

### PoC
1. Add XSS to admin locale (e.g. app/locale/en_US/local.csv):
    ```
    "Read Details","<img src=x onerror=alert(123)>"
    "Mark as Read","<script>alert(123)</script>"
    ```
2. Flush Cache. Make sure locale is set to en_US.
3. Add any admin notification (e.g. via test.php)
     ```
    <?php
    require 'app/Mage.php';
    Mage::app('admin');
    Mage::getModel('adminnotification/inbox')->setData([
        'severity'  => Mage_AdminNotification_Model_Inbox::SEVERITY_NOTICE,
        'date_added' => now(),
        'title' => 'XSS renderer test',
        'description' => 'Testing actions renderer',
        'url' => 'https://example.com', // makes the "Read Details" link appear
        'is_read' => 0, // makes the "Mark as Read" link appear
        'is_remove' => 0,
    ])->save();
    ```
4. Open Admin → System → Notifications → Inbox.
5. Profit.

### Impact
The vulnerability is only exploitable by an attacker with administrative or translation privileges. Malicious JavaScript may be executed in a victim’s browser when they browse to the admin page containing the vulnerable fields.
GitHub Security Advisory: GHSA-g582-8vwr-68h2
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 2.27.2
Patched in: 2.27.2

Summary: MantisBT unauthorized disclosure of private project column configuration

Details:
### Impact

Due to insufficient access-level checks, any non-admin user having access to _manage_config_columns_page.php_ (typically project managers having MANAGER role) can use the _Copy From_ action to retrieve the columns configuration from a private project they have no access to. 

Access to the reverse operation (_Copy To_) is correctly controlled, i.e. it is not possible to alter the private project's configuration.

### Patches
The vulnerability will be fixed in MantisBT version 2.27.2. 

### Workarounds
None

### Credits
Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.
GitHub Security Advisory: GHSA-q747-c74m-69pr
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: < 2.27.2
Patched in: 2.27.2

Summary: MantisBT lacks verification when changing a user's email address

Details:
When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user.

### Impact
This could result in storing an invalid email address, preventing the user from receiving system notifications.

Notifications sent to another person's email address could lead to information disclosure.

### Patches
Fixed in 2.27.2.

### Workarounds
None

### Credits

Thanks to @ncrcs for discovering and reporting the issue.
GitHub Security Advisory: GHSA-r3jf-hm7q-qfw5
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.27.2
Patched in: 2.27.2

Summary: MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length

Details:
A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:

### Impact
- The entire activity stream becomes unviewable (UI fails to render).
- New notes cannot be displayed, effectively breaking all future collaboration on the issue.

### Patches
Fixed in 2.27.2.

### Workarounds
None

### Credits
Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.
GitHub Security Advisory: GHSA-4v8w-gg5j-ph37
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 9.1)
CWE: CWE-305: Authentication Bypass by Primary Weakness, CWE-697: Incorrect Comparison
Vulnerable versions: < 2.27.2
Patched in: 2.27.2

Summary: MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

Details:
Due to an incorrect use of loose (`==`) instead of strict (`===`) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.

[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication_api.php#L782

### Impact
On MantisBT instances configured to use the *MD5* login method, user accounts having a password hash evaluating to zero (i.e. matching regex `^0+[Ee][0-9]+$`) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a  hash evaluating to zero, for example `comito5` (0e[PII_REDACTED][PII_REDACTED][PII_REDACTED]). 

No password bruteforcing for individual users is needed, thus $g_max_failed_login_count does not protect against the attack.

### Patches
* https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb[PII_REDACTED]faa748f9a2

### Workarounds
Check the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL:
```sql
SELECT username, email FROM mantis_user_table WHERE password REGEXP '^0+[Ee][0-9]+$'
```

### References
- https://mantisbt.org/bugs/view.php?id=35967

### Credits
Thanks to Harry Sintonen / Reversec for discovering and reporting the issue.
GitHub Security Advisory: GHSA-g59r-24g3-h7cm
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.22.0
Patched in: 5.22.1

Summary: Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

Details:
### Impact

Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

This affects:

- Control panel users with permission to create or edit Collections and Taxonomies
- Versions up to and including 5.22.0

The vulnerability can be exploited to:

- Change a super admin's password (versions ≤ 5.21.0)
- Change a super admin's email address to initiate password reset (version 5.22.0)
- Gain unauthorized access to superadmin accounts

The attack requires:

- An authenticated user with control panel and content creation permissions
- A super admin to view the compromised content

### Patches

This has been fixed in 5.22.1.

### Credits

Statamic thanks [Wojtek Chwala](https://github.com/wojtekchwala) for responsibly reporting the identified issues and working with us as we addressed them.
GitHub Security Advisory: GHSA-m3f2-xjgc-2wp2
Package: drupal/json_field (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.5
Patched in: 1.5

Summary: Drupal JSON Field is vulnerable to XSS

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS). This issue affects JSON Field: from 0.0.0 before 1.5.
GitHub Security Advisory: GHSA-pr6m-qwrr-mrw9
Package: drupal/plausible_tracking (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.2
Patched in: 1.0.2

Summary: Drupal Plausible tracking is vulnerable to XSS

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS). This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
GitHub Security Advisory: GHSA-x957-32v9-m7vg
Package: drupal/acquia_dam (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 1.1.5
Patched in: 1.1.5

Summary: Drupal Acquia DAM allows Forceful Browsing

Details:
Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing. This issue affects Acquia DAM: from 0.0.0 before 1.1.5.
GitHub Security Advisory: GHSA-jqmq-fpwv-p925
Package: drupal/simple_oauth (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: >= 6.0.0, < 6.0.7
Patched in: 6.0.7

Summary: Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass

Details:
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass. This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
GitHub Security Advisory: GHSA-h72q-cq3w-h3wc
Package: drupal/civictheme (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.12.0
Patched in: 1.12.0

Summary: Drupal CivicTheme Design System allows Cross-Site Scripting (XSS)

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS). This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
GitHub Security Advisory: GHSA-qxr9-f877-9842
Package: drupal/civictheme (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.12.0
Patched in: 1.12.0

Summary: Drupal CivicTheme Design System allows Forceful Browsing

Details:
Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing. This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
GitHub Security Advisory: GHSA-jxp8-4jw5-5xjc
Package: drupal/umami_analytics (COMPOSER)
Severity: LOW (CVSS 3.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.1
Patched in: 1.0.1

Summary: Drupal Umami Analytics allows Cross-Site Scripting (XSS)

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS). This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
GitHub Security Advisory: GHSA-27fv-rpgj-4c6m
Package: drupal/currency (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 3.5.0
Patched in: 3.5.0

Summary: Drupal Currency allows Cross Site Request Forgery

Details:
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery. This issue affects Currency: from 0.0.0 before 3.5.0.
GitHub Security Advisory: GHSA-fg8x-q69g-4qp3
Package: drupal/reverse_proxy_header (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-1288: Improper Validation of Consistency within Input
Vulnerable versions: < 1.1.2
Patched in: 1.1.2

Summary: Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables

Details:
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables. This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
GitHub Security Advisory: GHSA-27mc-9399-r9mx
Package: drupal/access_code (COMPOSER)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 2.0.5
Patched in: 2.0.5

Summary: Drupal Access code allows Brute Force Attempts

Details:
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force. This issue affects Access code: from 0.0.0 before 2.0.5.