We have determined that Realname module and Realname userreference module do not share information that should be hidden. After all, both account->name and realname fields are _intended_ for display. Therefore this is not considered a vulnerability. Mori Sugimoto (http://drupal.org/user/82971 ) Drupal Security Team Coordinator
