bugtraq - [CVE-REQUEST] Plone XSS and permission errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201105261406.p4QE66iq008617@www5.securityfocus.com>
Date: Thu, 26 May 2011 08:06:06 -0600
From: matthew@...thewwilkes.name
To: bugtraq@...urityfocus.com
Subject: [CVE-REQUEST] Plone XSS and permission errors

Hello all,

As a member of the Plone security response team I hereby notify you that we have been made aware of three distinct security holes in Plone and are requesting CVE identifiers.

1. Reflected XSS attack
A crafted URL can display arbitrary HTML output

2. Persistent XSS attack
Certain valid HTML will allow Javascript filtering to be bypassed.

3. Unauthorised data changes
One change form for data allows preferences to be changed.  No deletion of content of loss of confidentiality is possible.

Thanks very much, 

Matthew