Drupal 6.15 (latest release) is vulnerable to multiple permanent Cross Site Scritpting and probably the old release too. The severity is anyway low, because an attacker can use it only if he has an access to 'User Management' with the right privileges. The first vulnerability is up in 'Access rules'. In fact the attacker can write a code in 'Mask' entry textbox and after the submit the code will be executed. The second vulnerability, similar to the first, is allocated in 'Roles management', in fact the attacker, can use 'Name Role' for add malicius code, that will be executed after the submit viewing the related page list. These vulnerabilities are 'permanent'.