CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-10-21 11:22:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add a note to improve escaping in submit.cgi

Browse source
This commit is contained in:
fyodor 2012-06-02 21:24:15 +00:00
parent 8e7edbd008
commit 931352f92a
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
todo/nmap.txt
View file

@ -7,6 +7,11 @@ o Zenmap hang on OS X 10.7
o We should add fields to the service submitter
(http://insecure.org/cgi-bin/submit.cgi?new-service) for the
application name and version.
o We also need to ensure all fields of /cgi-bin/submit.cgi have
proper escapting to prevent possible reflected XSS attacks
reported by Maxim Rupp (@mmrupp). The risk is low, if any, since
we don't give authentication cookies for bad guys to steal, but is
still better to properly escape.
o Migrate web.insecure.org to a RHEL-6 derived distro (probably CENTOS
6, since Linode doesn't currently offer ScientificLinux images).