mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-11-24 00:45:52 +00:00
Code Issues Releases Activity

- Add entry for www/serendipity and www/serendipity-devel

Browse Source 
Reviewed by:	markus@
Approved by:	portmgr (implicit VuXML), secteam (Remko (not reviewed yet))
This commit is contained in:
Martin Wilke 2006-10-23 13:15:30 +00:00
parent dd2570c756
commit 100c045e82
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=175500
1 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
security/vuxml/vuln.xml
View File

@ -34,6 +34,41 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="96ed277b-60e0-11db-ad2d-0016179b2dd5">
<topic>Serendipity -- XSS Vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Serendipity Team reports:</p>
<blockquote cite="http://blog.s9y.org/archives/147-Serendipity-1.0.2-and-1.1-beta5-released.html">
<p>Serendipity failed to correctly sanitize user input on the
media manager administration page. The content of GET variables
were written into JavaScript strings. By using standard string
evasion techniques it was possible to execute arbitrary
JavaScript.</p>
<p>Additionally Serendipity dynamically created a HTML form on
the media manager administration page that contained all
variables found in the URL as hidden fields. While the variable
values were correctly escaped it was possible to break out
by specifying strange variable names.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hardened-php.net/advisory_112006.136.htmlSerendipity</url>
<url>http://secunia.com/advisories/22501/</url>
</references>
<dates>
<discovery>2006-10-19</discovery>
<entry>2006-10-21</entry>
</dates>
</vuln>
<vuln vid="d8fbf13a-6215-11db-a59e-0211d85f11fb">
<topic>kdelibs -- integer overflow in khtml</topic>
<affects>