FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-2833

This CVE name corresponds to:

Entered	Topic
2006-07-13	drupal -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-2833 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-2833
Phase	Assigned(20060605)

Description

Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable.

References

Source	Reference
BUGTRAQ	20060602 [DRUPAL-SA-2006-008] Drupal 4.6.8 / 4.7.2 fixes XSS issue
CONFIRM	http://drupal.org/node/66767
CONFIRM	http://drupal.org/files/sa-2006-008/4.6.7.patch
DEBIAN	DSA-1125
BID	18245
VUPEN	ADV-2006-2112
SECUNIA	20412
SECUNIA	21244
SREASON	1041
XF	drupal-taxonomy-xss(26893)