[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201401300454.s0U4sMLc002888@linus.mitre.org>
Date: Wed, 29 Jan 2014 23:54:22 -0500 (EST)
From: cve-assign@...re.org
To: puneethis021@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE: Request
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I have reported cross site scripting(xss) in Nokia Maps & Places(v:1.6.6)
> wordpress plugin.
> Issue Fixed on : 20/01/2014
> https://plugins.trac.wordpress.org/changeset?new=842384%40nokia-mapsplaces%2Ftrunk%2Fnokia-mapsplaces.php&old=802499%40nokia-mapsplaces%2Ftrunk%2Fnokia-mapsplaces.php
> https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=841883
> fixing href sec. issue. Place is is extracted instead of passing the full url which can be compromised
> https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=842384
> adding context to placeid when stored, removing href to prevent url injection
Use CVE-2014-1750.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS6dgPAAoJEKllVAevmvms2RUIALgdXfCiG7qNw9vDGay7u6fK
k00XiXVomz74EZ5NcFQhowXeDD7w/3SB/b1184DSxeAyV8OgzbNNZIM2eebb3n/7
ZeoVni1mifs9SreoQj1mp8bzSr/IDCUgjU58qAHYC7Bekqw1Sy/nSvWFfEGxxxJ3
paccCGcfJqcJyoIVuAKJre0avFB7fXXsFwovOjgto/K4TqDGa2wabrYF9lcx6kew
3uu3D4gyBdCbioZRhoe0F5R32XQrlHep9OX9wIhveIKUV/JqHxROxO+3oZmjDpr4
qU5qVvG1eLy7ZOM3bl/rQWnEE6opoNLJ/HonQxN2d9rXXwlnh+tLl5m3AjM46jU=
=oS6K
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
