darksecurity.de | Entries from Sunday, September 25. 2011

Warning: opendir(/var/www/html/web1/serendipity/plugins/serendipity_event_dpsyntaxhighlighter/sh/3.0.83.2/scripts/): failed to open dir: No such file or directory in /var/www/html/web1/serendipity/plugins/serendipity_event_dpsyntaxhighlighter/serendipity_event_dpsyntaxhighlighter.php on line 26

Warning: Invalid argument supplied for foreach() in /var/www/html/web1/serendipity/plugins/serendipity_event_dpsyntaxhighlighter/serendipity_event_dpsyntaxhighlighter.php on line 170
Skip to content

SSCHADV2011-016 - Serendipity freetag plugin 'serendipity[tagview]' Cross-Site Scripting vulnerability

Posted by Stefan Schurtz on Sunday, September 25. 2011

Advisory:	Serendipity freetag plugin ‘serendipity[tagview]’ Cross-Site Scripting vulnerability
Advisory ID:	SSCHADV2011-016
Author:	Stefan Schurtz
Affected Software:	Successfully tested on Serendipity 1.5.5
Vendor URL:	http://www.s9y.org
Vendor Status:	fixed
CVE-ID:	-

======================
Vulnerability Description:
======================

The freetag plugin parameter "serendipity[tagview]" in Serendipity backend is prone to a Cross-Site Scripting vulnerability

Continue reading "SSCHADV2011-016 - Serendipity freetag plugin 'serendipity[tagview]' Cross-Site Scripting vulnerability"