Date: Wed, 5 Sep 2012 10:42:38 +0000 (UTC) From: Eygene Ryabinkin <rea@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r303700 - head/security/vuxml Message-ID: <201209051042.q85Agc90020129@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rea Date: Wed Sep 5 10:42:38 2012 New Revision: 303700 URL: http://svn.freebsd.org/changeset/ports/303700 Log: VuXML: document XSS in MoinMoin before 1.9.4 via RST parser Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Sep 5 10:41:28 2012 (r303699) +++ head/security/vuxml/vuln.xml Wed Sep 5 10:42:38 2012 (r303700) @@ -51,6 +51,38 @@ Note: Please add new entries to the beg --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="4a8a98ab-f745-11e1-8bd8-0022156e8794"> + <topic>moinmoin -- cross-site scripting via RST parser</topic> + <affects> + <package> + <name>moinmoin</name> + <range><lt>1.9.4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>MITRE CVE team reports:</p> + <blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1058">; + <p>Cross-site scripting (XSS) vulnerability in the + reStructuredText (rst) parser in parser/text_rst.py in + MoinMoin before 1.9.4, when docutils is installed or when + "format rst" is set, allows remote attackers to inject + arbitrary web script or HTML via a javascript: URL in the + refuri attribute.</p> + </blockquote> + </body> + </description> + <references> + <bid>46476</bid> + <cvename>CVE-2011-1058</cvename> + <url>http://moinmo.in/SecurityFixes</url>; + </references> + <dates> + <discovery>2011-02-21</discovery> + <entry>2012-09-05</entry> + </dates> + </vuln> + <vuln vid="4f99e2ef-f725-11e1-8bd8-0022156e8794"> <topic>moinmoin -- wrong processing of group membership</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201209051042.q85Agc90020129>