diff options
| author | Thierry Thomas <thierry@FreeBSD.org> | 2010-09-28 17:09:35 +0000 |
|---|---|---|
| committer | Thierry Thomas <thierry@FreeBSD.org> | 2010-09-28 17:09:35 +0000 |
| commit | ab6d2d5a2f18a6a0078bf1a61c6c8b3bddf35d59 (patch) | |
| tree | 220ebafee09a5b02ed84a33415c1c3ecc1987a90 /security/vuxml/vuln.xml | |
| parent | 6f6993c4b4b246e6cbc385decc0ea94b9f0968ae (diff) | |
| download | ports-ab6d2d5a2f18a6a0078bf1a61c6c8b3bddf35d59.tar.gz ports-ab6d2d5a2f18a6a0078bf1a61c6c8b3bddf35d59.zip | |
Notes
Diffstat (limited to 'security/vuxml/vuln.xml')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index d703a69ead72..8c5e896cd9bb 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="8fc55043-cb1e-11df-9c1b-0011098ad87f"> + <topic>horde-base -- XSS and CSRF vulnerabilities</topic> + <affects> + <package> + <name>horde-base</name> + <range><lt>3.3.9</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Horde team reports:</p> + <blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/515"> + <p>Thanks to Naumann IT Security Consulting for reporting the XSS + vulnerability.</p> + <p>Thanks to Secunia for releasing an advisory for the new CSRF + protection in the preference interface</p> + <p>The major changes compared to Horde version 3.3.8 are:</p> + <p>* Fixed XSS vulnerability in util/icon_browser.php.</p> + <p>* Protected preference forms against CSRF attacks.</p> + </blockquote> + </body> + </description> + <references> + <url>http://article.gmane.org/gmane.comp.horde.announce/515</url> + <url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.607&r2=1.515.2.620&ty=h</url> + <url>http://secunia.com/advisories/39860/</url> + <url>http://holisticinfosec.org/content/view/145/45/</url> + </references> + <dates> + <discovery>2010-06-03</discovery> + <entry>2010-09-28</entry> + </dates> + </vuln> + <vuln vid="80b6d6cc-c970-11df-bb18-0015587e2cc1"> <topic>openx -- remote code execution vulnerability</topic> <affects> |