First published: Thu Sep 10 2009(Updated: )
Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Drupal Drupal | ||
Karen Stevenson Date | =6.x-1.0-beta | |
Karen Stevenson Date | =6.x-1.x-dev | |
Karen Stevenson Date | =6.x-2.0 | |
Karen Stevenson Date | =6.x-2.0-rc1 | |
Karen Stevenson Date | =6.x-2.0-rc2 | |
Karen Stevenson Date | =6.x-2.0-rc3 | |
Karen Stevenson Date | =6.x-2.0-rc4 | |
Karen Stevenson Date | =6.x-2.0-rc5 | |
Karen Stevenson Date | =6.x-2.0-rc6 | |
Karen Stevenson Date | =6.x-2.0-beta | |
Karen Stevenson Date | =6.x-2.0-beta2 | |
Karen Stevenson Date | =6.x-2.0-beta3 | |
Karen Stevenson Date | =6.x-2.0-beta4 | |
Karen Stevenson Date | =6.x-2.1 | |
Karen Stevenson Date | =6.x-2.2 | |
All of | ||
Drupal Drupal | ||
Any of | ||
Karen Stevenson Date | =6.x-1.0-beta | |
Karen Stevenson Date | =6.x-1.x-dev | |
Karen Stevenson Date | =6.x-2.0 | |
Karen Stevenson Date | =6.x-2.0-rc1 | |
Karen Stevenson Date | =6.x-2.0-rc2 | |
Karen Stevenson Date | =6.x-2.0-rc3 | |
Karen Stevenson Date | =6.x-2.0-rc4 | |
Karen Stevenson Date | =6.x-2.0-rc5 | |
Karen Stevenson Date | =6.x-2.0-rc6 | |
Karen Stevenson Date | =6.x-2.0-beta | |
Karen Stevenson Date | =6.x-2.0-beta2 | |
Karen Stevenson Date | =6.x-2.0-beta3 | |
Karen Stevenson Date | =6.x-2.0-beta4 | |
Karen Stevenson Date | =6.x-2.1 | |
Karen Stevenson Date | =6.x-2.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.