Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: smokeping XSS
From: Florian Weimer <fw () deneb enyo de>
Date: Mon, 27 Feb 2012 20:26:05 +0100

* Vincent Danen:


Is the patch


really correct?  It does not strip the two magic characters "=
(" should be enough, = is just defensive), so it's probably still
possible to inject an onmouseover handler and CSS which enlarges the
affected HTML element so that the handler is practically guaranteed to

I've just looked at the patch, I haven't got a (patched or unpatched)
smokeping instance to test this.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]