Joomla! before 1.5.4 allows attackers to access administration functionality, which has unknown impact and attack vectors related to a missing “LDAP security fix.”

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to “an inappropriate placeholder for ‘numeric’ fields.”

Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules “terminate the current request during a login event,” allows remote attackers to hijack web sessions via unknown vectors.

Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities.

Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of “translated strings.”