geronimo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "alfred kamra (JIRA)" <j...@apache.org>
Subject [jira] Commented: (GERONIMO-1474) Cross site scripting vulnerabilites
Date Tue, 13 Mar 2007 03:27:09 GMT

    [ https://issues.apache.org/jira/browse/GERONIMO-1474?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12480249
] 

alfred kamra commented on GERONIMO-1474:
----------------------------------------

<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/52/index.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/52/index.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/53/lite1.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/53/lite1.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/54/lite2.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/54/lite2.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/55/lite3.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/55/lite3.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/56/lite4.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/56/lite4.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/57/lite5.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/57/lite5.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/58/lite6.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/58/lite6.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/59/lite7.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/59/lite7.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/60/lite8.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/60/lite8.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/61/lite9.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/61/lite9.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/62/lite10.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/62/lite10.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/63/lite11.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/63/lite11.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/64/lite12.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/64/lite12.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/65/lite13.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/65/lite13.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/66/lite14.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/66/lite14.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/67/lite15.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/67/lite15.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/68/lite16.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/68/lite16.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/69/lite17.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/69/lite17.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/70/lite18.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/70/lite18.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/71/lite19.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/71/lite19.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/72/lite20.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/72/lite20.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/73/lite21.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/73/lite21.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/74/lite22.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/74/lite22.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/75/lite23.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/75/lite23.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/76/lite24.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/76/lite24.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/77/lite25.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/77/lite25.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/78/lite26.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/78/lite26.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/79/lite27.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/79/lite27.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/80/lite28.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/80/lite28.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/81/lite29.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/81/lite29.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/82/lite30.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/82/lite30.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/83/lite31.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/83/lite31.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/84/lite32.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/84/lite32.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/85/lite33.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/85/lite33.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/86/lite34.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/86/lite34.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/87/lite35.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/87/lite35.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/88/lite36.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/88/lite36.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/89/lite37.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/89/lite37.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/90/lite38.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/90/lite38.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/91/lite39.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/91/lite39.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/92/lite40.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/92/lite40.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/93/lite41.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/93/lite41.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/94/lite42.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/94/lite42.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/95/lite43.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/95/lite43.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/96/lite44.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/96/lite44.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/97/lite45.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/97/lite45.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/98/lite46.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/98/lite46.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/99/lite47.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/99/lite47.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/100/lite48.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/100/lite48.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/101/lite49.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/101/lite49.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/102/lite50.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/102/lite50.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/103/lite51.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/103/lite51.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/104/lite52.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/104/lite52.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/105/lite53.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/105/lite53.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/106/lite54.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/106/lite54.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/107/lite55.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/107/lite55.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/108/lite56.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/108/lite56.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/109/lite57.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/109/lite57.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/110/lite58.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/110/lite58.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/112/lite59.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/112/lite59.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/113/lite60.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/113/lite60.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/114/lite61.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/114/lite61.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/115/lite62.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/115/lite62.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/116/lite63.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/116/lite63.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/117/lite64.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/117/lite64.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/118/lite65.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/118/lite65.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/119/lite66.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/119/lite66.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/120/lite67.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/120/lite67.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/121/lite68.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/121/lite68.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/122/lite69.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/122/lite69.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/123/lite70.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/123/lite70.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/124/lite71.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/124/lite71.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/125/lite72.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/125/lite72.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/126/lite73.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/126/lite73.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/127/lite74.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/127/lite74.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/128/lite75.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/128/lite75.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/129/lite76.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/129/lite76.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/130/lite77.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/130/lite77.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/131/lite78.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/131/lite78.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/132/lite79.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/132/lite79.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/133/lite80.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/133/lite80.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/134/lite81.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/134/lite81.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/135/lite82.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/135/lite82.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/136/lite83.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/136/lite83.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/137/lite84.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/137/lite84.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/138/lite85.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/138/lite85.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/139/lite86.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/139/lite86.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/140/lite87.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/140/lite87.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/141/lite88.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/141/lite88.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/142/lite89.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/142/lite89.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/143/lite90.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/143/lite90.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/144/lite91.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/144/lite91.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/145/lite92.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/145/lite92.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/146/lite93.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/146/lite93.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/148/lite94.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/148/lite94.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/149/lite95.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/149/lite95.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/150/lite96.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/150/lite96.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/151/lite97.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/151/lite97.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/152/lite98.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/152/lite98.html</a>
<a href="http://forge.cujae.edu.cu/tracker/download.php/19/167/15/153/lite99.html">http://forge.cujae.edu.cu/tracker/download.php/19/167/15/153/lite99.html</a>

> Cross site scripting vulnerabilites
> -----------------------------------
>
>                 Key: GERONIMO-1474
>                 URL: https://issues.apache.org/jira/browse/GERONIMO-1474
>             Project: Geronimo
>          Issue Type: Bug
>      Security Level: public(Regular issues) 
>          Components: console, security
>    Affects Versions: 1.0
>            Reporter: Greg Wilkins
>         Assigned To: Aaron Mulder
>             Fix For: 1.1, 1.2
>
>         Attachments: GERONIMO-1474.patch
>
>
> Reported by oliver karow:
> The Web-Access-Log viewer does no filtering for html-/script-tags, and
> therefore allows attacks against the user of the admin-console:
> http://10.10.10.10:8080/jsp-examples/cal/cal2.jsp?time="/><script>alert(document.cookie)</script>
> Also reported:
> The first one is a classical cross-site scripting in the jsp-examples:
> http://10.10.10.10:8080/jsp-examples/cal/cal2.jsp?time="/><script>alert('Gotcha')</script>

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message