Security advisories

The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models.

The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure.

This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow.

The Location Selector module provides a Views filter for selecting location values.

One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability.

This vulnerability is mitigated by the fact that a View must exist that uses the affected filter and is configured to accept user input.

The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page.

The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an attacker to use a brute force attack to bypass the protection provided by this module. The security fix blocks these attempts with flood control.

This vulnerability is mitigated by the fact that an attacker must obtain a valid username & password.

This module enables you to test and run AI-driven workflows interactively through a chat interface.

The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the user.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer FlowDrop workflows" (or the equivalent "Create FlowDrop workflows" / "Edit FlowDrop workflows" permissions).