Drupal versions 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 suffer from cross site scripting flaws due to various quirks in interpretation of non-sensical attribute values.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/42030/DRUPAL-SA-2005-007.txt
Source: https://packetstormsecurity.com/files/42030/DRUPAL-SA-2005-007.txt.html