Info

Disclosure

Aug 12, 2005

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

MindAlign contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified variables upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 6.0 or higher, as it has been reported to fix this vulnerability. In addition, Parlano has released a patch for some older versions. Contact Parlano support at support@parlano.com for an upgrade.

Products

Parlano, Inc.

MindAlign

5.0

References

Bugtraq ID: 14562
Secunia Advisory ID: 16408
Related OSVDB ID: 18754 18756 18757
CVE ID: 2005-2590 (see also: NVD)
ISS X-Force ID: 21837
Vendor URL: http://www.parlano.com/mindalign/default.aspx
Other Advisory URL: http://www.uniras.gov.uk/niscc/docs/br-20050812-00673.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/18755