These were unearthed by https://slacprod.service-now.com/sys_attachment.do?sys_id=5ef99ae9dbbed300e8bffd0d0f961936

Connectivity.pl

XSS vulnerability against the format parameter in the QUERY_STRING.

  • Fixed by not reflecting the input from the format parameter.

XSS vulnerability against the rawdata parameter in the QUERY_STRING.

  • Fixed by using &valid_ip to validate parameter is a valid IP name or a valid IPv4 or IPv6 address and exiting if not.

XSS vulnerability against http://www-iepm.slac.stanford.edu/cgi-bin/connectivity.pl/%27%20onmouseover%3D%27alert%289%29%3B%27.

 

  • No labels