lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: 7 Apr 2008 23:27:55 -0000 From: brad.antoniewicz@...ndstone.com To: bugtraq@...urityfocus.com Subject: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities Title: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities Vendor URL: http://wiki.squeak.org/swiki Vendor Contacted: Yes Description: Multiple stored and reflective cross-site scripting vulnerabilities were identified in Swiki 1.5. Reflective (example): http://[host]:8000/<script>alert("XSS");</script> Stored (example): On posts to 1.append when adding new entries into the wiki, the application does not properly escape javascript code resulting in a stored cross-site scripting attack. Credit: Brad Antoniewicz brad.antoniewicz@...ndstone.com