|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
Hushmail.com Information for VU#361600
| Date Notified: | |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Vulnerable |
Vendor StatementThe vulnerability has been fixed. We have no record of a notification on September 5th, or we certainly would have fixed this earlier. It was a very straightforward issue involving a failure to use the htmlspecialchars() PHP function in that area of the code. It is our general practice to always use this method when displaying information using PHP in order to avoid such scripting vulnerabilities, and we regret the unfortunate oversight.
Many thanks to 1; and everyone else who has helped us keep HushMail secure in the past.Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumThe CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
