Search:

Control scan is asking for the following info to mark it as a false positive:

Is there any type of url/content filtering?

What pattern matching is done to prevent this vulnerability.

What about in 1.3.8? Any patch?

1.3.8 with all security patches. I rather not post a url if it really is an issue. If one of the devs wants the url I can pm it.

Any ideas? Is this a false positive on a pci scan:

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. They seem to be vulnerable to a 'format string'...