Drupal : Security Vulnerabilities, CVEs, Published In August 2008 (XSS)
The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.
Max CVSS
3.5
EPSS Score
0.11%
Published
2008-08-27
Updated
2017-08-08
Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Max CVSS
4.3
EPSS Score
0.31%
Published
2008-08-27
Updated
2017-08-08
Cross-site scripting (XSS) vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms.
Max CVSS
4.3
EPSS Score
0.25%
Published
2008-08-06
Updated
2017-08-08
3 vulnerabilities found