First published: Thu Sep 10 2009(Updated: )
Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with "create new content types" privileges, to inject arbitrary web script or HTML via the title of a content type.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Drupal Drupal | ||
Karen Stevenson Calendar | =6.x-2.0 | |
Karen Stevenson Calendar | =6.x-2.0-beta | |
Karen Stevenson Calendar | =6.x-2.0-beta2 | |
Karen Stevenson Calendar | =6.x-2.0-beta3 | |
Karen Stevenson Calendar | =6.x-2.0-beta4 | |
Karen Stevenson Calendar | =6.x-2.0-rc1 | |
Karen Stevenson Calendar | =6.x-2.0-rc2 | |
Karen Stevenson Calendar | =6.x-2.0-rc3 | |
Karen Stevenson Calendar | =6.x-2.0-rc4 | |
Karen Stevenson Calendar | =6.x-2.0-rc5 | |
Karen Stevenson Calendar | =6.x-2.0-rc6 | |
Karen Stevenson Calendar | =6.x-2.1 | |
Karen Stevenson Calendar | =6.x-2.x-dev | |
All of | ||
Drupal Drupal | ||
Any of | ||
Karen Stevenson Calendar | =6.x-2.0 | |
Karen Stevenson Calendar | =6.x-2.0-beta | |
Karen Stevenson Calendar | =6.x-2.0-beta2 | |
Karen Stevenson Calendar | =6.x-2.0-beta3 | |
Karen Stevenson Calendar | =6.x-2.0-beta4 | |
Karen Stevenson Calendar | =6.x-2.0-rc1 | |
Karen Stevenson Calendar | =6.x-2.0-rc2 | |
Karen Stevenson Calendar | =6.x-2.0-rc3 | |
Karen Stevenson Calendar | =6.x-2.0-rc4 | |
Karen Stevenson Calendar | =6.x-2.0-rc5 | |
Karen Stevenson Calendar | =6.x-2.0-rc6 | |
Karen Stevenson Calendar | =6.x-2.1 | |
Karen Stevenson Calendar | =6.x-2.x-dev |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.