qnd: patches for:
- cross-site scripting vulnerabilities have been discovered in the application?s user frontend. The affected module is the API documentation which gives the user the possibility to gather more information about the provided services and objects. 
Since the user input is not properly sanitized and not output encoding is performed, attackers have the possibility to inject malicious JavaScript code. Affected parameters are ?service? and ?object?.

- An XML injection vulnerability has been discovered in the application?s user frontend. As a result of missing input validation and absent output encoding, attackers have the possibility to inject malicious JavaScript code in a dynamic generated XML document provided by the application. 
This issue appears in the application?s API. The affected parameter is ?service?. 
- Attack pattern: 

<html:html xmlns:html='http://www.w3.org/1999/xhtml'><html:script>alert('EUROSEC'); </html:script></html:html> 

- Proof of concept URI: 
  http://mediashare-prod-srv1.wdf.sap.corp:8080/api_v3/index.php?service=%3Chtml:html%20xmlns:html=%27http://www.w3.org/1999/xhtml%27%3E%3Chtml:script%3Ealert%28%27EUROSEC%27%29;%20%3C/html:script%3E%3C/html:html%3E&action=update 

- Accessing the URI given above will lead to successful execution of user-provided JavaScript in the client?s browser. 



git-svn-id: svn+ssh://kelev.kaltura.com/usr/local/kalsource/backend/server/trunk/on-premise/all@94388 6b8eccd3-e8c5-4e7d-8186-e12b5326b719
qnd:
cross-site scripting vulnerabilities have been discovered in the application?s user frontend. The affected module is the API documentation which gives the user the possibility to gather more information about the provided services and objects. 
Since the user input is not properly sanitized and not output encoding is performed, attackers have the possibility to inject malicious JavaScript code. Affected parameters are 'service' and 'object'.


git-svn-id: svn+ssh://kelev.kaltura.com/usr/local/kalsource/backend/server/trunk/on-premise/all@94389 6b8eccd3-e8c5-4e7d-8186-e12b5326b719
qnd: adapted to github paths