CVE-2008-4152

CVE-2008-4152 is a cross-site scripting issue in Drupal’s Talk module (5.x before 5.x-1.3 and 6.x before 6.x-1.5). It enables remote authenticated users to inject arbitrary web script/HTML via a node title. Affected versions are prior to the specified fixes; remediation is to upgrade to 5.x-1.3 a...

CVE-2008-4153

The Talk module for Drupal (5.x before 5.x-1.3 and 6.x before 6.x-1.5) fails to perform access checks on a node before displaying its comments, enabling remote users to view sensitive information. Root cause: missing access checks in the module. Impact: information disclosure. Remediation: upgrad...