Uwe Hermann

**Name of the Vulnerable Software and Affected Versions** Drupal versions 4.6.x before 4.6.10 Drupal versions 4.7.x before 4.7.4 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed, due to multiple cross-site scripting (XSS) vulnerabilities in the XML parser. **Recommendations** For Drupal versions 4.6.x before 4.6.10, update to version 4.6.10 or later. For Drupal versions 4.7.x before 4.7.4, update to version 4.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 4.5.x through 4.5.7 Drupal versions 4.6.x through 4.6.7 **Description** The issue allows remote attackers to inject headers of outgoing e-mail messages, potentially using the system as a spam proxy. This is due to a CRLF injection vulnerability. **Recommendations** For versions 4.5.x through 4.5.7, update to version 4.5.8 or later. For versions 4.6.x through 4.6.7, update to version 4.6.8 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 4.5.x through 4.5.7 Drupal versions 4.6.x through 4.6.7 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions 4.5.x through 4.5.7, update to version 4.5.8 or later. For versions 4.6.x through 4.6.7, update to version 4.6.8 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 4.5.x through 4.5.7 Drupal versions 4.6.x through 4.6.7 **Description** The issue is related to access control when the menu.module is used to create a menu item. It does not implement access control for the referenced page, which could allow remote attackers to access administrator pages. **Recommendations** For Drupal versions 4.5.x through 4.5.7, update to version 4.5.8 or later. For Drupal versions 4.6.x through 4.6.7, update to version 4.6.8 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 4.4.0 through 4.6.0 **Description** The issue is related to an unknown vulnerability in the privilege system. When public registration is enabled, remote attackers can gain privileges due to an input check that is not implemented properly. **Recommendations** For versions 4.4.0 through 4.6.0, consider disabling public registration as a temporary workaround until a patch is available. Restrict access to the privilege system to minimize the risk of exploitation.