Update: Vulnerability in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron

["MustLive" <mustlive () websecurity com ua>]

Hello list!

One update concerning Cross-Site Scripting vulnerability in multiple plugins 
for different engines (in plugins for Typepad, RapidWeaver, Habari, DasBlo, 
eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and 
Sweetcron, which all are ports of WP-Cumulus). Which I wrote about earlier.

Besides, EZcumulus for eZ Publish, there is another vulnerable plugin eZ 
Flash Tag Cloud - it's another plugin for eZ Publish (with tagcloud.swf). 
Which is supported by developers, unlike EZcumulus.

Vulnerable version eZ Flash Tag Cloud 1.0. After my informing, the 
developers fixed XSS in version 1.1 
(http://projects.ez.no/ezflashtagcloud/forum/general/flash_tag_cloud_v1_1_security_update), 
but it's still vulnerable to HTML Injection.

Concerning EZcumulus then, as representative of eZ Systems told me, because 
of that EZcumulus is not supported, then downloading of it was disabled at 
official site (and it'll not be updated to fix this issue). So it's 
recommended for all eZ Publish users, who are using EZcumulus, to change it 
to eZ Flash Tag Cloud 1.1.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/