lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20090416150010.2995.qmail@securityfocus.com>
Date: 16 Apr 2009 15:00:10 -0000
From: ddvulnalert@...fronline.com
To: bugtraq@...urityfocus.com
Subject: DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

Title
-----
DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

Severity
--------
Low

Date Discovered
---------------
February 23rd, 2009

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: David Marshall and r@...$

Vulnerability Description
-------------------------
ActiveMQ 5.2.0’s /admin interface gathers input from the user in numerous forms which are not properly sanitized.  Attackers may insert script tags to have them execute when a user browses the affected areas of the page.

Solution Description
--------------------
User-supplied inputs should not be rendered as executable script code when presented back to the user.

Tested Systems / Software (with versions)
------------------------------------------
Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary

Vendor Contact
--------------
Vendor Name: The Apache Software Foundation
Vendor Website: http://activemq.apache.org/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ