FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-4786

This CVE name corresponds to:

Entered	Topic
2009-12-12	pligg -- Cross-Site Scripting and Cross-Site Request Forgery

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-4786 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-4786
Phase	Assigned(20100421)

Description

Multiple cross-site scripting (XSS) vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to (1) admin/admin_config.php, (2) admin/admin_modules.php, (3) delete.php, (4) editlink.php, (5) submit.php, (6) submit_groups.php, (7) user_add_remove_links.php, and (8) user_settings.php.

References

Source	Reference
MISC	http://holisticinfosec.org/content/view/130/45/
CONFIRM	http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/
SECUNIA	37349