Date: Mon, 6 Dec 2010 16:51:39 -0500 (EST) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: coley <coley@...re.org> Subject: Re: CVE request: vanilla forums before 2.0.10, xss Use CVE-2010-4264 for the XSS. The commit is here: https://github.com/vanillaforums/Garden/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece As for the "linkbait" issue, I have no clue. Nothing in git seems to point at that. Steve, does MITRE have a precedent for such a thing? Thanks. -- JB ----- "Hanno Böck" <hanno@...eck.de> wrote: > Hi, > > http://vanillaforums.org/discussion/13119/vanilla-2.0.10-released/p1 > > Two sound like security: > # > # Added SafeStyles configuration to prevent XSS linkjacking > # Patched potential linkbait vulnerability in dispatcher > > (although I don't know what a linkbait vulnerability is, maybe someone > wants > to enlighten me) > > -- > Hanno Böck Blog: http://www.hboeck.de/ > GPG: 3DBD3B20 Jabber/Mail: hanno@...eck.de > > http://schokokeks.org - professional webhosting
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.