oss-security - CVE request: serendipity

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 29 Aug 2010 21:26:09 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: CVE request: serendipity < 1.5.4 xss

http://blog.s9y.org/archives/223-Serendipity-1.5.4-released.html

http://www.htbridge.ch/advisory/xss_vulnerability_in_serendipity.html

"as well as a XSS security issue discovered and reported by High-Tech Bridge. 
The XSS is only exploitable though, if you are using the "Remember me" feature 
in the Serendipity backend to login."



-- 
Hanno Böck		Blog:		http://www.hboeck.de/
GPG: 3DBD3B20		Jabber/Mail:	hanno@...eck.de

http://schokokeks.org - professional webhosting

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.