[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201401201632.s0KGWDgP015688@linus.mitre.org>
Date: Mon, 20 Jan 2014 11:32:13 -0500 (EST)
From: cve-assign@...re.org
To: forest.monsen@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for Drupal contributed modules
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Hi there, I'd like to request CVE identifiers for:
>
> SA-CONTRIB-2013-098 - Ubercart - Session Fixation Vulnerability
> https://drupal.org/node/2158651
Use CVE-2013-7302. The advisory says "attacker must have access to the
original session ID of the victim." Do you know whether the relevant
attacks occur at times when this original session ID is invalid?
> SA-CONTRIB-2014-001 - Entity API - Access Bypass
> https://drupal.org/node/2169595
This file already has CVE identifiers.
> SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)
> https://drupal.org/node/2173321
Use CVE-2014-1611.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS3U4rAAoJEKllVAevmvms/7cH/i58BA1NhJhsoyjo3zKSycwt
uPDk9TT2mW7OTamRD/GNnx7MdIMD4noiu37Hdl9fCenDovZDFo73Lr1mQkMQpLrh
DSvyt3TSQ5PSxGnv3e3KbK5Gj2FNyYSkaQ3tenhZJ7mL4/gXgAoZJs3LEXD8uwc9
Jl5gvcRJ0Zy0UOC7OavQoi+nvvOeqbY2FlyA4zAL9uZbNL5zOx5kiKLUdDXOYv44
3HjGQwvr9Aek9nC2Rvs9B3ETxPjNP/gIXQCDjWZF1cAm1Kof4+t7jXmqjJsyscQB
GGWnAy6ps1E+7pTAPOC5eWiwPuOrqaVK/h6JyP7IW5aPS4v0qMYu+jaXQFz4mac=
=c31C
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
