lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <005701cc7257$e47e85c0$9b7a6fd5@ml> Date: Tue, 13 Sep 2011 23:57:42 +0300 From: "MustLive" <mustlive@...security.com.ua> To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk> Subject: Update: Vulnerability in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron Hello list! One update concerning Cross-Site Scripting vulnerability in multiple plugins for different engines (in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron, which all are ports of WP-Cumulus). Which I wrote about earlier. Besides, EZcumulus for eZ Publish, there is another vulnerable plugin eZ Flash Tag Cloud - it's another plugin for eZ Publish (with tagcloud.swf). Which is supported by developers, unlike EZcumulus. Vulnerable version eZ Flash Tag Cloud 1.0. After my informing, the developers fixed XSS in version 1.1 (http://projects.ez.no/ezflashtagcloud/forum/general/flash_tag_cloud_v1_1_security_update), but it's still vulnerable to HTML Injection. Concerning EZcumulus then, as representative of eZ Systems told me, because of that EZcumulus is not supported, then downloading of it was disabled at official site (and it'll not be updated to fix this issue). So it's recommended for all eZ Publish users, who are using EZcumulus, to change it to eZ Flash Tag Cloud 1.1. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists