oss-security - Re: CVE request: Multiple security vulnerabilities in ARSC Really Simple Chat

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 2 Jun 2011 16:13:34 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE request: Multiple security vulnerabilities
 in ARSC Really Simple Chat



----- Original Message -----
> Could you assign CVE-identifiers for following security
> vulnerabilities?
> 
> https://sourceforge.net/tracker/?func=detail&aid=3310673&group_id=32699&atid=406296
> http://www.htbridge.ch/advisory/xss_in_a_really_simple_chat_arsc.html
> http://www.htbridge.ch/advisory/multiple_sql_injections_in_a_really_simple_chat_arsc.html
> 
> ARSC seems to be a bit of a sinking boat. I still wonder why htbridge
> does not request CVE-identifiers at all.
> 


This needs two IDs:

CVE-2011-2180 ARSC XSS
CVE-2011-2181 ARSC SQL injection

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.