Description
Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks."
References
- http://drupalcode.org/project/realname.git/commitdiff/b920794
- http://drupal.org/node/1547660
- 48936 third-party-advisory
- [oss-security] 20120502 Re: CVE Request for Drupal contributed modules mailing-list
- 53250 vdb-entry
- realname-unspecified-xss(75181) vdb-entry
- http://drupal.org/node/1547352
- http://drupalcode.org/project/realname.git/commitdiff/41786d0
- [oss-security] 20120502 CVE Request for Drupal contributed modules mailing-list