AOH :: HP Unsorted B :: TB13367.HTM

broadcast machine XSS

CVE-2007-3694: Cross site scripting (XSS) in broadcast machine
CVE-2007-3694: Cross site scripting (XSS) in broadcast machine

Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline


Cross site scripting (XSS) in broadcast machine


 Cross site scripting describes attacks that allow to insert malicious html or 
 javascript code via get or post forms. This can be used to steal session
 Broadcast machine is a web-based video platform tool. It's login form is
 vulnerable to XSS.

Sample code
action="" method="post">
Workaround/Fix Vendor consideres broadcast machine dead software and won't provide any updates. However it's still used on some live sites in the internet. CVE Information The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-3694 to this issue. This is a candidate for inclusion in the CVE list (, which standardizes names for security problems. Credits and copyright This vulnerability was discovered by Hanno Boeck of webhosting. It's licensed under the creative commons attribution license. Hanno Boeck, 2007-11-12, --nextPart3581826.sm6rzc6rZB Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) iD8DBQBHOE0rr2QksT29OyARAkS2AJ90gXA6QDni/o4yRTor6JETPJmgfQCggch+ jDHiO2S9hCmCm8r8MulWwh4=SIIi -----END PGP SIGNATURE----- --nextPart3581826.sm6rzc6rZB--

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to