Hi chort! I'm glad that you liked this XSS in swfupload (in different flash-files of it). If you like vulnerabilities in flash applications, then feel free to look at all those flash related holes, which I've published for last five years. Since Persistent XSS in Invision Power Board, which I've found at 12.12.2007, and till last holes in multiple web applications with swfupload.
XSS via swf-files it's just XSS, nothing new :-) (I'm posting reflected and persistent XSS and CS via flash for five years). Just revealing new vulnerable web applications. Don't worry, I've wrote all necessary posts about multiple web applications with different versions of swfupload (for swfupload.swf, swfupload_f8.swf, swfupload_f9.swf, swfupload_f10.swf and swfupload_f11.swf). Later I'll write about another vulnerable flash-file ;-). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua ----- Original Message ----- From: "bk" <[email protected]> To: "MustLive" <[email protected]> Cc: "Full Disclosure" <[email protected]>; <[email protected]> Sent: Wednesday, November 21, 2012 10:22 PM Subject: Re: [Full-disclosure] XSS vulnerability in swfupload in TinyMCE, SPIP, Radiant CMS, AionWeb, Liferay Portal, SurgeMail, symfony Imma let you finish, but this: http://securityreactions.tumblr.com/post/35703074237/mustlive-has-posted-a-new-xss-technique Nah, I lied. Don't bother finishing. -- chort On Nov 21, 2012, at 10:35 AM, MustLive wrote: > Hello list! > > I will draw your attention to XSS vulnerability _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
