Date: Tue, 18 Aug 2009 16:45:45 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- WordPress On Tue, 21 Jul 2009, Jan Lieskovsky wrote: > latest WordPress 2.8.2 version has addressed a XSS vulnerability: > > XSS via unescaped HTML URLs as author comments in the admin page ====================================================== Name: CVE-2009-2851 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2851 Reference: MLIST:[oss-security] 20090721 CVE Request -- WordPress Reference: URL:http://www.openwall.com/lists/oss-security/2009/07/21/1 Reference: CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=278492 Reference: CONFIRM:http://wordpress.org/development/2009/07/wordpress-2-8-2/ Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=512900 Reference: FEDORA:FEDORA-2009-8109 Reference: URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01241.html Reference: FEDORA:FEDORA-2009-8114 Reference: URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01253.html Reference: SECTRACK:1022589 Reference: URL:http://securitytracker.com/id?1022589 Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.