A cross site scripting vulnerability in DasBlog’s Event and Activity Viewer allows to inject and execute code on the client’s machine. This allows an attacker to transfer the ASP.NET authentication cookie to a server of his choice. The attacker can use this cookie to log on to DasBlog and modify blog entries and configuration settings.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/34237/ERNW-SA.Newtelligence.txt
Source: https://packetstormsecurity.com/files/34237/ERNW-SA.Newtelligence.txt.html