Some vulnerabilities have been reported in ht://Dig, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "config" and "sort" parameters isn't properly sanitised before being returned to the user in an error message. This may be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

Solution
Filter malicious characters and character sequences in a proxy server or firewall with URL filtering capabilities.

Provided and/or discovered by
Michael Krax and Michael Skibbe

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://sourceforge.net/mailarchive/forum.php?thread_name=200709251310.55835.mskibbe%40suse.de&forum_name=htdig-dev

Deep Links
Links available to Secunia VIM customers