SlashcodeSlash Open Source ProjectTwo Slash Data Sanitization Security Issues- June 16, 2008 Two longstanding security issues were found and fixed in Slash, the code that powers Slashdot, in May 2008. The second of the two -- found and reported to us by Scott R. White, of securestate.com -- is easily exploitable and must be fixed immediately on all Slash 2.x sites. The first, found and fixed on May 1, was a problem with filtering certain types of form data: form inputs where the form name is matched against a regex. At some point years ago, during refactoring, the code was changed to...http://www.slashcode.com/article.pl?sid=08/06/16/1318232&from=rss |