Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Cross-Site Scripting vulnerability in CorePlayer
From: "MustLive" <mustlive () websecurity com ua>
Date: Sun, 28 Oct 2012 23:56:38 +0200

Hello list!

I want to warn you about Cross-Site Scripting vulnerability in CorePlayer.

This is the same flash video player, which was used at online voting
translations - today, 28.10.2012, on parliamentary elections in Ukraine and
earlier this year on presidential elections in Russia.

Concerning elections in Ukraine. At spending 993.6 million gryvnas (approx.
$124.2 million) for webcam setup (including development of web site for
online translations), they haven't found money for security.

Affected products:

Vulnerable are CorePlayer 4.0.6 and previous versions. At web site
webvybory2012.ru version 1.3.2 is used and at web site vybory2012.gov.ua
version 4.0.6 is used.


XSS (WASC-08):





I mentioned about this vulnerability at my site

Best wishes & regards,
Administrator of Websecurity web site

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Cross-Site Scripting vulnerability in CorePlayer MustLive (Oct 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]