| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 23 Sep 2013 13:17:54 -0300 From: Alexandro Silva <alexos@...iss.com.br> To: bugtraq@...urityfocus.com Subject: [IBliss Security Advisory] Cross-site scripting ( XSS ) in Bradesco gateway wordpress plugin [ Bradesco Gateway Wordpress plugin Cross-site scripting ( XSS ) ] [ Vendor product description] Bradesco Gateway for the WP-Ecommerce plugin. [ Bug Description ] Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin before 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML. [ History ] Advisory sent to vendor on 09/04/2013 Contact vendor again on 09/13/2013 Contact vendor again on 09/20/2013 Advisory sent to Wordpress plugin team on 09/20/2013 [ Impact ] HIGH [ Afected Version ] 2.0 [ Vendor Reply ] No Vendor team response. No Wordpress plugin response. [ CVE Reference ] CVE-2013-5916 [ PoC ] Payload: http://[host]/> /wordpress/wp-content/plugins/wp-e-commerce/wpsc-merchants/bradesco-gateway/falha.php?1%3CScRiPt%3Eprompt%28%27XSS%27%29%3C/ScRiPt%3E [ References ] [1] Bradesco-gateway - http://plugins.svn.wordpress.org/bradesco-gateway/trunk/bradesco-gateway.php [2] Owasp Cross-site scripting - https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ -------------------------------------------- iBliss Segurança e Inteligência - Sponsor: Alexandro Silva - Alexos alexos (at) ibliss.com (dot) br [email concealed]
Powered by blists - more mailing lists