[VIM] blogBuddies XSS issues include MagpieRSS

[Steven M. Christey]

FYI, regarding the recent blogbuddies XSS issues (CVE-2005-3954,
CVE-2005-3955).  blogbuddies includes a separate product, magpieRSS,
and that's what some of the reported vectors are in.

The same magpie vectors were listed in a PHP-Nuke issue
(CVE-2005-1695)


- Steve


======================================================
Name: CVE-2005-1695
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1695
Reference: BUGTRAQ:20050521 [SECURITYREASON.COM] PostNuke XSS 0.760{RC2,RC3}
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=111670482500552&w=2
Reference: BUGTRAQ:20050521 [SECURITYREASON.COM] PostNuke XSS and Full path disclosure
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=111670506926649&w=2
Reference: CONFIRM:http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2691

Multiple cross-site scripting (XSS) vulnerabilities in the RSS module
in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to
inject arbitrary web script or HTML via the (1) rss_url parameter to
magpie_slashbox.php, or the url parameter to (2) magpie_simple.php or
(3) magpie_debug.php.


======================================================
Name: CVE-2005-3954
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3954
Reference: CONFIRM:http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847
Reference: BID:15555
Reference: URL:http://www.securityfocus.com/bid/15555
Reference: SECUNIA:17741
Reference: URL:http://secunia.com/advisories/17741

Cross-site scripting (XSS) vulnerability in blogBuddies 0.3 allows
remote attackers to inject arbitrary web script or HTML via the u
parameter to index.php.


======================================================
Name: CVE-2005-3955
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3955
Reference: CONFIRM:http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847
Reference: BID:15555
Reference: URL:http://www.securityfocus.com/bid/15555
Reference: SECUNIA:17741
Reference: URL:http://secunia.com/advisories/17741

Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1,
as used in blogBuddies 0.3 and possibly other products, allow remote
attackers to inject arbitrary web script or HTML via the (1) url
parameter to magpie_debug.php; and rss_url parameter to (2)
magpie_slashbox.php and (3) simple_smarty.php.