What do drive-by attacks typically take advantage of when delivering exploits?

Server upload policies control what file types can be submitted to a server and play no role in the client-side exploit delivery mechanism used by drive-by attacks.

Drive-by attacks target the victim's web browser and associated components such as JavaScript engines, PDF reader plugins, or media handlers by embedding malicious exploit code in a webpage. The exploit executes automatically when the browser renders the page, requiring no deliberate download or further action from the user beyond visiting the site. The attack chain typically involves a browser or plugin vulnerability being exploited to silently execute a payload and establish persistence.

Outdated SSL/TLS versions represent a transport-layer weakness exploited for traffic interception or protocol downgrade attacks, not for browser-based payload delivery.

Weak passwords are an authentication attack surface and are unrelated to the browser vulnerability exploitation used as the delivery vector in drive-by campaigns.