:Alexandr Polyakov and Anton Karpov have reported a vulnerability in OpenBSD bgplg, which can be exploited by malicious people to conduct cross-site scripting attacks.Input via the "cmd" parameter to the bgplg cgi-bin script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.The vulnerability is reported in OpenBSD 4.1. OpenBSD 4.2 may also be affected.Solution:Filter malicious characters and character sequences using a web proxy. Fixed in CVS repository.http://www.openbsd.org/cgi-bin/cvsweb…gplg.c.diff?r1=1.6&r2=1.7&f=hProvided and/or discovered by:Alexandr Polyakov and Anton Karpov, Digital Security Research GroupOriginal Advisory:http://www.mail-archive.com/misc@openbsd.org/msg49057.htmlhttp://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c

Original post by Pankaj