[Dotclear Dev] Fwd: Inquiry on vulnerability found in Dotclear 2.6.3 VN: JVN#61637002 / TN: JP CERT#97966327JPCERT#97966327

Hello, Please be aware that Dotclear 2.6.2 is not the latest version: v2.6.3 was released in May to patch vulnerabilities found in 2.6.2 (listed at http://www.cvedetails.com/vulnerability-list/vendor_id-3572/Dotclear.html ) If the vulnerabilities you found are not the one listed and still exist in 2.6.3, please send any information to security(a)dotclear.net where you'll reach several members of the team (we do not use a GPG key). xave, for the Dotclear Team. On Wed, Jun 25, 2014 at 5:10 AM, JPCERT/CC <vuls(a)jpcert.or.jp&gt; wrote: > To whom it may concern, > > Hello. This is Noriko Takahashi from JPCERT/CC Vulnerability > Handling Team. Please excuse the sudden contact. > > If you're not familiar with us or our activities, please > check the following websites for more information. > > http://www.jpcert.or.jp/english/ > http://www.jpcert.or.jp/english/vh/project.html > http://www.meti.go.jp/english/information/data/IT-policy/securityl.htm > http://jvn.jp/en/ > > We have received a report of a vulnerability found in the > product "Dotclear 2.6.2" from a researcher/user here in Japan > under the vulnerability handling framework called "Information > Security Early Warning Partnership" and the official announcement > #235 "Software Vulnerability Related Information Handling Measures" > which were designed by Ministry of Economy, Trade and Industry (METI), > a Japanese cabinet. > > From the website > http://dotclear.org/contact > we found this email address. We would like to coordinate with you > to solve the reported vulnerability, and your cooperation would be > greatly appreciated. > > Before we provide you the details of the reported vulnerability, > we would like to know the appropriate point-of-contact person, > or department/group/team to communicate in regards to this issue. > It would be greatly appreciated if you could provide us the below > information at your earliest convenience. > -Name of the person/team who is in charge of such issues > -Email address > -PGP key if available > > Once we receive your reply and and point-of-contact information, > we will then send you the original vulnerability report and the > details either in a PGP encrypted message or in a password protected > zip file. > > If you have any questions or concerns, please do not hesitate > to contact us any time. > > Thank you in advance for your attention to this email. > We would very much appreciate your prompt reply. > > Sincerely yours, > > Noriko Takahashi > Leader of Vulnerability Handling Team > Information Coordination Group