Reflected Cross Site Scripting (XSS) Vulnerability

vishal_alt · November 6, 2017, 10:49am

The RemObjects SDK for Delphi v1.0.0.0 is vulnerable to reflected Cross Site Scripting (XSS) attack.

RemObjectsSoftware · November 7, 2017, 7:51am

Thanks, logged as bugs://78944

RemObjectsSoftware · November 7, 2017, 7:51am

bugs://78944 got closed with status fixed.

EvgenyK · November 7, 2017, 7:53am

generated html is:

<html><head><title>Error</title></head><body><font size=7>Error</font><br />An error occurred generating WSDL: Invalid TargetEntity "&lt;script&gt;alert(&apos;bla-bla-bla&apos;);&lt;/script&gt;"</body></html>

vishal_alt · November 7, 2017, 8:08am

May I know the version in which this vulnerability will get the fix ?
Does this vulnerability has any vulnerability candidate identity ?

EvgenyK · November 7, 2017, 8:37am

Fix will be in this week’s beta
all other possible places for this vulnerability also should be fixed.

vishal_alt · November 7, 2017, 9:24am

Thanks EvgenyK for prompt reply.