Re: CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)

[Henri Salo <henri () nerv fi>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Oct 13, 2014 at 10:38:03PM +0200, oststrom (public) wrote:
> CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via
> xmlrpc API (post-auth)

Can you confirm that this should be CVE-2014-2021 and not 2013 ID, thank you.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2021 says:

"pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial
of service (out-of-bounds-read) via a crafted length value in an encrypted PDF
file."

- ---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlQ84GUACgkQXf6hBi6kbk+iHQCfegUzTUZ/F2c80FKAz++m8snY
s8oAn2j9Hjx1QSkWmJTx/vS8ciKpG+Ud
=F6yu
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/