full-disclosure - Re: [FD] CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)

Open Source and information security mailing list archives

Date: Tue, 14 Oct 2014 11:35:49 +0300
From: Henri Salo <henri@...v.fi>
To: "oststrom (public)" <pub@...strom.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in
 AdminCP/ApiLog via xmlrpc API (post-auth)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Oct 13, 2014 at 10:38:03PM +0200, oststrom (public) wrote:
> CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via
> xmlrpc API (post-auth)

Can you confirm that this should be CVE-2014-2021 and not 2013 ID, thank you.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2021 says:

"pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial
of service (out-of-bounds-read) via a crafted length value in an encrypted PDF
file."

- ---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlQ84GUACgkQXf6hBi6kbk+iHQCfegUzTUZ/F2c80FKAz++m8snY
s8oAn2j9Hjx1QSkWmJTx/vS8ciKpG+Ud
=F6yu
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives