lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAAygdYNZyXVp1yVMXD79t17nK+K=dfaGq_VykRtD_nFEvC9f3A@mail.gmail.com>
Date: Wed, 23 Oct 2013 13:38:44 +0200
From: Fran <jfrancisco.bolivar@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject:  [CVE-2013-6239]Contexis 1.0 CMS, Reflected Xss

CVE-2013-6239:Contexis 1.0 CMS, Reflected Xss

Severity: Medium

Vendor: exis-ti.com

Versions Affected: 1.0

Description: The contexist has be found the reflected XSS Vulnerability if
use the photo gallery model someone can insert xss code at the url
executing javascript codes on the web.

Exploit:


GET /publicas/galeria-imagenes/Galeria-XXXXX.html?action=detail&image=<XSS
code>

Solution: update to Contexis 2.0 CMS

Credit: This issue was discovered by  Juan Francisco Bolivar
es.linkedin.com/in/jfbolivar/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6239
-- 


Un saludo, Juan Francisco

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ