EUVD-2014-3166

Malware in sbrugna...

Cross site scripting

Cross-site scripting XSS vulnerability in libahttp/err.c in OkCupid OKWS OK Web Server allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to a non-existent page, which is not properly handled in a 404 error page...

CVE-2014-3148

CVE-2014-3148 is an XSS vulnerability in OkCupid OKWS (OK Web Server), originating from the libahttp/err.c handling of PATH_INFO for non-existent pages. A remote attacker can inject arbitrary web script/HTML by crafting a request to a non-existent page, exploiting improper filtering on the 404 er...