CVE-2010-2472

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting XSS attack. This vulnerability is mitigat...

CVE-2010-2473

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked...

Cross site scripting

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting XSS attack. This vulnerability is mitigat...

Design/Logic Flaw

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked...

CVE-2010-2250

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack...

CVE-2010-2250

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack...

Cross site scripting

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack...

CVE-2010-2473

Drupal 6.x before 6.16 and Drupal 5.x before 5.22 allow a user with an open session that has been blocked to continue an active session on the site. This is caused by insufficient blocking logic, enabling the blocked user to maintain access despite enforcement of a block. The issue is documented ...

CVE-2010-2473

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked...

CVE-2010-2472

CVE-2010-2472 affects Drupal 6.x < 6.16 and 5.x

CVE-2010-2472

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting XSS attack. This vulnerability is mitigat...

CVE-2010-2250

CVE-2010-2250 affects Drupal 5.x and 6.x up to 6.15/6.16, where a user-supplied value is echoed during site installation, enabling cross-site scripting via a crafted URL. Evidence in multiple sources confirms Drupal-based XSS risk and indicates mitigations exist in later Drupal releases (6.16+; D...

CVE-2010-2250

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack...

CVE-2010-2471

Drupal versions 5.x and 6.x has open redirection...

CVE-2010-2471

Drupal versions 5.x and 6.x has open redirection...

Open redirect

Drupal versions 5.x and 6.x has open redirection...

CVE-2010-2471

Drupal versions 5.x and 6.x has open redirection...

CVE-2010-2471

CVE-2010-2471 affects Drupal 5.x and 6.x and concerns the API function drupal_goto(), which is vulnerable to open redirection/phishing. Exploitation would allow an attacker to redirect users to an arbitrarily provided URL. Public disclosures in Red Hat, Debian, and Ubuntu advisories describe the ...

DRUPAL-CONTRIB-2019-075

Open Social is a Drupal distribution for online communities. The included social\magic\login module doesn't sufficiently validate magic login URLs for user accounts that do not have a local password, but login via external systems. The lack of validation makes it possible for an adversary to forg...

Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075

Open Social is a Drupal distribution for online communities. The included socialmagiclogin module doesn't sufficiently validate magic login URLs for user accounts that do not have a local password, but login via external systems. The lack of validation makes it possible for an adversary to forge...