Vulnerabilities

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.

Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS.

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.