From be03f0c48eb85981125f3992a8686bc54d9b54fa Mon Sep 17 00:00:00 2001 From: Martin Wilke Date: Fri, 19 Dec 2008 20:29:46 +0000 Subject: - document drupal -- Multiple vulnerabilities --- security/vuxml/vuln.xml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 5d376e981f9b..de68d798c813 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,42 @@ Note: Please add new entries to the beginning of this file. --> + + drupal -- multiple vulnerabilities + + + drupal5 + 5.14 + + + drupal6 + 6.8 + + + +

The Drupal Project reports:

+
The update system is vulnerable to Cross site request forgeries. + Malicious users may cause the superuser (user 1) to execute old + updates that may damage the database.
+
When an input format is deleted, not all existing content on a site + is updated to reflect this deletion. Such content is then displayed + unfiltered. This may lead to cross site scripting attacks when harmful + tags are no longer stripped from 'malicious' content that was posted + earlier.
+

+ + + + http://drupal.org/node/345441 + http://secunia.com/advisories/33112/ + + + 2008-12-11 + 2008-12-19 + + + mozilla -- multiple vulnerabilities -- cgit v1.2.3