Description

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.

Remediation

References

CVE-2015-6658

Related Vulnerabilities

Oracle Database Server Other Vulnerability (CVE-2002-0843)

OpenSSL Numeric Errors Vulnerability (CVE-2012-2333)

Java Unspesificed Vulnerability (CVE-2018-3136)

PHP Improper Input Validation Vulnerability (CVE-2010-3870)

Magento Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2019-7864)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2015-6658