diff options
| author | wxs <wxs@FreeBSD.org> | 2009-01-13 11:19:19 +0800 |
|---|---|---|
| committer | wxs <wxs@FreeBSD.org> | 2009-01-13 11:19:19 +0800 |
| commit | 3dcce3527d86d918daac8f786f0bad8036342fc4 (patch) | |
| tree | eaf586910f359bfb6e3e7f31e0368c52578a7f7e /security | |
| parent | e3c7da33947e3b17d99102e22ca7debd8914e4b6 (diff) | |
| download | freebsd-ports-gnome-3dcce3527d86d918daac8f786f0bad8036342fc4.tar.gz freebsd-ports-gnome-3dcce3527d86d918daac8f786f0bad8036342fc4.tar.zst freebsd-ports-gnome-3dcce3527d86d918daac8f786f0bad8036342fc4.zip | |
- Document cgiwrap XSS vulnerability
PR: ports/130277
Submitted by: Eric W. Bates <ericx@vineyard.net>
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f3071da4e7ab..583a17435102 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="bc6a7e79-e111-11dd-afcd-00e0815b8da8"> + <topic>cgiwrap -- XSS Vulnerability</topic> + <affects> + <package> + <name>cgiwrap</name> + <range><lt>4.0_2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Secunia reports:</p> + <blockquote cite=""> + <p>A vulnerability has been reported in CGIWrap, which can be + exploited by malicious people to conduct cross-site scripting + attacks.</p> + <p>The vulnerability is caused due to the application generating + error messages without specifying a charset. This can be exploited + to execute arbitrary HTML and script code in a user's browser + session in context of an affected site.</p> + <p>Successful exploitation may require that the victim uses Internet Explorer or a browser based on Internet Explorer components.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2008-2852</cvename> + </references> + <dates> + <discovery>2008-06-19</discovery> + <entry>2009-01-13</entry> + </dates> + </vuln> + <vuln vid="d4a358d3-e09a-11dd-a765-0030843d3802"> <topic>nagios -- web interface privilege escalation vulnerability</topic> <affects> |