<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>What version of Zend.to are you running? There is a known XSS in an earlier version of code.<br><br>Brian Pocock - Consultant<div>Nebulas </div></div><div><br>On 1 Mar 2016, at 22:14, Keith Erekson <<a href="mailto:kbe2@lehigh.edu">kbe2@lehigh.edu</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta content="text/html; charset=windows-1252" http-equiv="Content-Type">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Tested on Mac OS X 10.10, seems to work in Firefox (41 and 44), but
not Chrome (48) nor Safari (9).<br>
<br>
(pickup.php, not pickup/php for anyone who wants to try)<br>
<br>
~Keith<br>
<br>
On 03/01/2016 02:14 PM, Chris Venter wrote:<br>
<span style="white-space: pre;">> Hi<br>
><br>
> Our security audit has highlighted a possible reflected cross
site scripting error on the pickup.php page,to test we ran<br>
><br>
> <a class="moz-txt-link-freetext" href="https://server_name/pickup/php?emailAddr=test">https://server_name/pickup/php?emailAddr=test</a>"
/><script>alert('XSS Test')</script><br>
><br>
> Can anyone else confirm if this is an issue?<br>
><br>
> Thanks<br>
> CJ<br>
><br>
><br>
> _______________________________________________<br>
> ZendTo mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:ZendTo@zend.to">ZendTo@zend.to</a><br>
> <a class="moz-txt-link-freetext" href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.12 (GNU/Linux)<br>
<br>
iQEcBAEBCAAGBQJW1hMwAAoJEMdFVhhDm2SFxyEH+wVvzU2y4/Th4oMZKZruI+cb<br>
At3pe8Sh/pEbMYgLUr7jpnuRKMPXs2Q+W7r0f9m/7P8s0TYWsfpOBhW7v2FC7uQ5<br>
wep0NfZUByqFZpARocE9WB/2zRxh6oxOOy1RCcZjjnCNKBF2aVBvJUF7kfl2O57O<br>
CwsWnXfosMNwBOsLTWzbSaV+FsoPLX4Ow5RH/cI1eBd64TLxOr+tmIsXatp+vua7<br>
dtilpqxehF1REMyZyJx0e6u2pTdrsFJ5HoPinkk8GbsS2Q+hFfctan7NMsUr2gdP<br>
BBmnSlSvAd3nzlFhlSApIA/+JbfSD6eooDcUxxNWJhWZP32s31+uTcg+OyIJWf8=<br>
=tpYG<br>
-----END PGP SIGNATURE-----<br>
<br>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>ZendTo mailing list</span><br><span><a href="mailto:ZendTo@zend.to">ZendTo@zend.to</a></span><br><span><a href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></span></div></blockquote><span style="font-size: 9px;"><strong>Company name:</strong> Nebulas Solutions Group Ltd <strong>Company Registration Number:</strong> 04281153 <strong>Place of Registration:</strong> England and Wales <strong>Registered Office Address:</strong> 256 Waterloo Road, London, SE1 8RF</span></body></html>