Some vulnerabilities have been reported in vbDrupal, which can be exploited by malicious users to conduct HTTP response splitting attacks, and by malicious people to conduct cross-site scripting and cross-site request forgery attacks, bypass certain security restrictions, and compromise a vulnerable system.

For more information:
SA27290
SA27292

The vulnerabilities are reported in versions prior to 5.3.0.

Solution
Update to version 5.3.0. Reconfigure the Upload module to disallow ".html" file uploads.
Original Advisory
http://sourceforge.net/project/shownotes.php?release_id=547880

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers