oss-sec mailing list archives
Re: CVE: Request
From: cve-assign () mitre org
Date: Wed, 29 Jan 2014 23:54:22 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
I have reported cross site scripting(xss) in Nokia Maps & Places(v:1.6.6) wordpress plugin.
Issue Fixed on : 20/01/2014
https://plugins.trac.wordpress.org/changeset?new=842384%40nokia-mapsplaces%2Ftrunk%2Fnokia-mapsplaces.php&old=802499%40nokia-mapsplaces%2Ftrunk%2Fnokia-mapsplaces.php
https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=841883 fixing href sec. issue. Place is is extracted instead of passing the full url which can be compromised
https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=842384 adding context to placeid when stored, removing href to prevent url injection
Use CVE-2014-1750. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS6dgPAAoJEKllVAevmvms2RUIALgdXfCiG7qNw9vDGay7u6fK k00XiXVomz74EZ5NcFQhowXeDD7w/3SB/b1184DSxeAyV8OgzbNNZIM2eebb3n/7 ZeoVni1mifs9SreoQj1mp8bzSr/IDCUgjU58qAHYC7Bekqw1Sy/nSvWFfEGxxxJ3 paccCGcfJqcJyoIVuAKJre0avFB7fXXsFwovOjgto/K4TqDGa2wabrYF9lcx6kew 3uu3D4gyBdCbioZRhoe0F5R32XQrlHep9OX9wIhveIKUV/JqHxROxO+3oZmjDpr4 qU5qVvG1eLy7ZOM3bl/rQWnEE6opoNLJ/HonQxN2d9rXXwlnh+tLl5m3AjM46jU= =oS6K -----END PGP SIGNATURE-----
Current thread:
- CVE: Request Puneeth Gowda (Jan 29)
- Re: CVE: Request cve-assign (Jan 29)