full-disclosure - Update: Vulnerability in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <005701cc7257$e47e85c0$9b7a6fd5@ml>
Date: Tue, 13 Sep 2011 23:57:42 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Update: Vulnerability in plugins for Typepad,
	RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity,
	Social Web CMS, PHP-Fusion, Magento and Sweetcron

Hello list!

One update concerning Cross-Site Scripting vulnerability in multiple plugins 
for different engines (in plugins for Typepad, RapidWeaver, Habari, DasBlo, 
eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and 
Sweetcron, which all are ports of WP-Cumulus). Which I wrote about earlier.

Besides, EZcumulus for eZ Publish, there is another vulnerable plugin eZ 
Flash Tag Cloud - it's another plugin for eZ Publish (with tagcloud.swf). 
Which is supported by developers, unlike EZcumulus.

Vulnerable version eZ Flash Tag Cloud 1.0. After my informing, the 
developers fixed XSS in version 1.1 
(http://projects.ez.no/ezflashtagcloud/forum/general/flash_tag_cloud_v1_1_security_update), 
but it's still vulnerable to HTML Injection.

Concerning EZcumulus then, as representative of eZ Systems told me, because 
of that EZcumulus is not supported, then downloading of it was disabled at 
official site (and it'll not be updated to fix this issue). So it's 
recommended for all eZ Publish users, who are using EZcumulus, to change it 
to eZ Flash Tag Cloud 1.1.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/