oss-security - Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F4BAB34.5060603@aliantsoft.pl>
Date: Mon, 27 Feb 2012 17:11:32 +0100
From: Mateusz Goik <mateusz.goik@...antsoft.pl>
To: Rafał Malinowski
 <rafal.przemyslaw.malinowski@...il.com>
CC: oss-security@...ts.openwall.com, 
 "Steven M. Christey" <coley@...us.mitre.org>,
 Mariusz Fik <fisiu@...nsuse.org>, 
 Radoslaw Lisowski <radoslaw.lisowski@...il.com>,
 kontakt@...antsoft.pl
Subject: Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing
 contact's status and sms messages in history

Hi,

I would add it is possible - read / create files on users hdd. (using
the method - GET / PUT)
Tested on Backtrack 5 r1 (kadu 0.10.0 - compiled from source).

Mateusz Goik

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.