full-disclosure - Re: XSS vulnerability in swfupload in TinyMCE, SPIP, Radiant CMS, AionWeb, Liferay Portal, SurgeMail, symfony

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <003101cdcb64$00cf82e0$9b7a6fd5@ml>
Date: Mon, 26 Nov 2012 01:24:02 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: XSS vulnerability in swfupload in TinyMCE,
	SPIP, Radiant CMS, AionWeb, Liferay Portal, SurgeMail, symfony

Hi chort!

I'm glad that you liked this XSS in swfupload (in different flash-files of
it). If you like vulnerabilities in flash applications, then feel free to
look at all those flash related holes, which I've published for last five
years. Since Persistent XSS in Invision Power Board, which I've found at
12.12.2007, and till last holes in multiple web applications with swfupload.

XSS via swf-files it's just XSS, nothing new :-) (I'm posting reflected and
persistent XSS and CS via flash for five years). Just revealing new
vulnerable web applications.

Don't worry, I've wrote all necessary posts about multiple web applications
with different versions of swfupload (for swfupload.swf, swfupload_f8.swf,
swfupload_f9.swf, swfupload_f10.swf and swfupload_f11.swf). Later I'll write
about another vulnerable flash-file ;-).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

----- Original Message ----- 
From: "bk" <chort0@...il.com>
To: "MustLive" <mustlive@...security.com.ua>
Cc: "Full Disclosure" <full-disclosure@...ts.grok.org.uk>;
<submissions@...ketstormsecurity.org>
Sent: Wednesday, November 21, 2012 10:22 PM
Subject: Re: [Full-disclosure] XSS vulnerability in swfupload in TinyMCE,
SPIP, Radiant CMS, AionWeb, Liferay Portal, SurgeMail, symfony

Imma let you finish, but this:
http://securityreactions.tumblr.com/post/35703074237/mustlive-has-posted-a-new-xss-technique

Nah, I lied. Don't bother finishing.

--
chort

On Nov 21, 2012, at 10:35 AM, MustLive wrote:

> Hello list!
>
> I will draw your attention to XSS vulnerability

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/