oss-security - CVE Request: Post Revolution multiple security vulnerabilities

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 24 May 2011 21:55:13 -0300
From: Javier Bassi <javierbassi@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: Post Revolution multiple security vulnerabilities

 Hi,  I need a CVE for Post Revolution 0.8c multiple security
vulnerabilities. (Post Revolution is a CMS similar to Wordpress
released under GPLv2)

The vulnerabilities are:
1. A Denial of service vulnerability.
2. Cross-site scripting vulnerabilities.
3. Cross-site request forgery vulnerabilities.

Vendor has publicly confirmed the existence of the vulnerabilities:
http://translate.google.com/translate?u=http%3A%2F%2Fpostrev.com.ar%2F&sl=es&tl=en&hl=&ie=UTF-8
I will wait for vendor to fully patch these issues before
full-disclosure (probably by Friday)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.