diff options
| author | Jason Helfman <jgh@FreeBSD.org> | 2012-04-19 03:12:32 +0000 |
|---|---|---|
| committer | Jason Helfman <jgh@FreeBSD.org> | 2012-04-19 03:12:32 +0000 |
| commit | f9ab7263f27b9fd2735c25c217f1992329980840 (patch) | |
| tree | 0e4006ac69193abb5eb48e7d70e1c1b2145fb454 /security | |
| parent | 0f190c07268fb43952e0910250017455c47d6ec0 (diff) | |
| download | ports-f9ab7263f27b9fd2735c25c217f1992329980840.tar.gz ports-f9ab7263f27b9fd2735c25c217f1992329980840.zip | |
Notes
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e41156036bc8..a4fe0176b504 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -52,6 +52,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="67516177-88ec-11e1-9a10-0023ae8e59f0"> + <topic>typo -- Cross-Site Scripting</topic> + <affects> + <package> + <name>typo3</name> + <range><ge>4.6.0</ge><le>4.6.7</le></range> + <range><ge>4.5.0</ge><le>4.5.14</le></range> + <range><ge>4.4.0</ge><le>4.4.14</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Typo Security Team reports:</p> + <blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/"> + <p> Failing to properly encode the output, the default TYPO3 Exception + Handler is susceptible to Cross-Site Scripting. We are not aware of + a possibilty to exploit this vulnerability without third party + extensions being installed that put user input in exception messages. + However it has come to our attention that extensions using the extbase + MVC framework can be used to exploit this vulnerability if these + extensions accept objects in controller actions.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2012-2112</cvename> + <url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/</url> + </references> + <dates> + <discovery>2012-04-17</discovery> + <entry>2012-04-18</entry> + </dates> + </vuln> + <vuln vid="0c14dfa7-879e-11e1-a2a0-00500802d8f7"> <topic>nginx -- Buffer overflow in the ngx_http_mp4_module</topic> <affects> |