[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201405220517.s4M5HO4G004617@linus.mitre.org>
Date: Thu, 22 May 2014 01:17:24 -0400 (EDT)
From: cve-assign@...re.org
To: dolev@...nflare.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Persistent XSS in Mayan EDMS - document management system
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> multiple persistent cross-site scripting vulnerabilities were found in
> the latest version of Mayan EDMS. it appears that new tags, folders
> and links that are created by any system user are not sanitized when
> viewed, allowing malicious code to be stored and executed.
> An attacker is able to create documents and tags with malicious code,
> potentially stealing admin cookies browsing or editing the documents.
> http://research.openflare.org/advisories/mayan-edms/multiple_stored_xss.txt
Use CVE-2014-3840.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTfYgZAAoJEKllVAevmvmstEEH/1FLyD6dcbgaJTYYuFRoMyvy
S84Wm1rDiQX2HSKbG8YJfQopwkFJlNys3gUdh6e3zjNq6UR7wHw4cCDuWZL+JpV0
Pa6G6XNFdoajAVRHX2DF+RSpKxj1763tLlr72UkbQjGtLg0J4f7luHyosSqf0eS3
Os5jZxNDoCGXz2md95pZB95V9lYPSJGp5e7TbDcc1QE0DjWcaQtjOXeSuUxpdU1j
bQ8fSENGdug0Fuqy8n2C/HsXac/phJGG7gZ1IBCGRM8cwqg5/mO8c41vkcW0mml/
zqXMzLAWUq5ycU3bty8mDfBv01yunFBMKIYg9AsOHjnEY58Bf+hcs92F6yRfSJs=
=9zbA
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
