[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0808141757570.17005@faron.mitre.org>
Date: Thu, 14 Aug 2008 17:59:51 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE request: openfire login page XSS (JM-629)
Notice that there were two distinct attacks/issues related to the username
parameter in 2005 - one was a basic XSS, then the vendor did an incomplete
fix, which left a variant XSS exposed.
- Steve
======================================================
Name: CVE-2005-4876
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4876
Reference: CONFIRM:http://www.igniterealtime.org/issues/browse/JM-430
Cross-site scripting (XSS) vulnerability in the login form (login.jsp)
of the admin console in Openfire (formerly Wildfire) 2.2.2, and
possibly other versions before 2.3.0 Beta 2, allows remote attackers
to inject arbitrary web script or HTML via the username parameter, a
different vulnerability than CVE-2005-4877.
======================================================
Name: CVE-2005-4877
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4877
Reference: CONFIRM:http://www.igniterealtime.org/issues/browse/JM-430
Cross-site scripting (XSS) vulnerability in the login form (login.jsp)
of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2
allows remote attackers to inject arbitrary web script or HTML via
Javascript events in the username parameter, a different vulnerability
than CVE-2005-4876.
======================================================
Name: CVE-2006-7233
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7233
Reference: MISC:http://www.igniterealtime.org/issues/browse/JM-430
Reference: MISC:http://www.igniterealtime.org/issues/browse/JM-629
Reference: OSVDB:47448
Reference: URL:http://www.osvdb.org/47448
Reference: SECUNIA:31483
Reference: URL:http://secunia.com/advisories/31483
Cross-site scripting (XSS) vulnerability in the login form (login.jsp)
of the admin console in Openfire (formerly Wildfire) 2.6.0, and
possibly other versions before 3.5.3, allows remote attackers to
inject arbitrary web script or HTML via the url parameter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
