[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: XSS in HTML Tidy plugin used in WYSIWYG HTML editors
From:       "Steven M. Christey" <coley () linus ! mitre ! org>
Date:       2008-10-28 0:08:03
Message-ID: Pine.GSO.4.51.0810272007310.1641 () faron ! mitre ! org
[Download RAW message or body]


======================================================
Name: CVE-2008-4761
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4761
Reference: MLIST:[oss-security] 20081027 XSS in HTML Tidy plugin used in WYSIWYG HTML editors
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/27/6
Reference: MISC:http://downloads.securityfocus.com/vulnerabilities/exploits/31908.html
Reference: BID:31908
Reference: URL:http://www.securityfocus.com/bid/31908
Reference: XF:esupport-htmltidylogic-xss(46097)
Reference: URL:http://xforce.iss.net/xforce/xfdb/46097

Cross-site scripting (XSS) vulnerability in
includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php in Kayako
eSupport 3.20.2 allows remote attackers to inject arbitrary web script
or HTML via the jsMakeSrc parameter.  NOTE: the provenance of this
information is unknown; the details are obtained solely from third
party information.  NOTE: this issue is probably in the HTMLArea
HTMLTidy (HTML Tidy) plugin, not eSupport.


[prev in list] [next in list] [prev in thread] [next in thread]