Description
The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Remediation
References
Related Vulnerabilities
WordPress Plugin Captcha by BestWebSoft Multiple Cross-Site Scripting Vulnerabilities (4.1.5)
IBM WebSEAL Inadequate Encryption Strength Vulnerability (CVE-2019-4151)
WordPress Plugin Secure HTML5 Video Player Cross-Site Scripting (3.14)
Magento Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-7932)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-0790)