V tomto přehledu si můžete prohlédnout různá bezpečnostní oznámení nahlášená do stable a current verze Frugalware
| Balíček: | drupal-simplenews |
| Datum: | 2008-09-26 |
| Příspěvek zaslal: | Miklos Vajna |
| Zranitelná verze: | 5.x_1.4-1 |
| Opravená verze: | 5.x_1.5-1solaria1 |
| Server pro hlášení chyb: | http://bugs.frugalware.org/task/3362 |
| CVE: | There is no CVE for this issue yet, see http://drupal.org/node/312944. |
| Popis chyby: | A vulnerability has been reported in the Simplenews module for Drupal, which can be exploited by malicious users to conduct script insertion attacks. Input passed as Newsletter categories is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires valid user credentials with the "administer taxonomy" permission. |