Full Disclosure mailing list archives
Re: Is OWASP vulnerable ??
From: czino2 () aol com
Date: Sun, 11 Mar 2007 12:05:37 -0400
The Knaller 2007 You surf in the Internet and pay billions others, to reach you as customers. It wouldn't be beautiful, if you could also get what ?? This is no more dream now. Agloco makes this possible. No costs or subsequent costs ?? and the income ?? Become partners and another 5 partners advertise. Everybody surfs for 5 hours in the month makes 761.25 dollars = with 10 partners 1517.50 dollars = (The computer is in the member area) Registering now free of charge. In addition, you get money in the Internet by the surfing at activated view beard. 100% of the profit are distributed to the members by AGLOCOT because. The one who further builds up the community can in addition earn more: because you recommend AGLOCOT per more persons, you can make a the higher profit. This comes that not only your online hours but also that one of your recommendations be collected on your account. And just as also the hours of the recommendations of your recommendations up to the 5th level! This will be a strong drive for this to extend the member number very fast for certain. In the month, you can get more as 7,000 shares if e.g. you have attracted 10 persons, and each of these in turn 5 persons! Lose no time. This is a Win-Win opportunity and all the more profitable it gets for you if you still have your friends and family registered today before others make it! -----Ursprüngliche Mitteilung----- Von: jf () danglingpointers net An: kishfellow () yahoo com Cc: full-disclosure () lists grok org uk Verschickt: So., 11. Mrz. 2007, 10:11 Thema: Re: [Full-disclosure] Is OWASP vulnerable ?? Sorry, I didn't mention this in my original reply, if you type the variable name into google you'll get several hits from the wiki software they use, appearantly it used to be considered a security hole by the authors of the software if the wiki was embedded in another frame, so thats what that check was, however anymore it is disabled by default, and web app authors being what they are, disabled most likely means they commented out the declaration. On Sat, 10 Mar 2007, Scarlet Pimpernel wrote:
Date: Sat, 10 Mar 2007 13:06:34 -0800 (PST) From: Scarlet Pimpernel <kishfellow () yahoo com> To: Andrew Farmer <andfarm () gmail com> Cc: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] Is OWASP vulnerable ?? Hey Andrew :) Corrected the blog entry, Thanks for your email... Also added "jf at danglingpointers dot net" ... since he was the first to
reply.
I hope this is just a bug, probably something that could cause minimal damage
and not a vulnerability.
Cheers :) Kish Andrew Farmer <andfarm () gmail com> wrote: On 10 Mar 07, at 09:23, Scarlet
Pimpernel wrote:
Hello all, There is an undefined function in OWASP website's javascript code (wikibits.js) called wgBreakFrames. This can cause potential damage to the site if used maliciously....if (wgBreakFrames) {... First of all, that's a variable, not a function. Creating a function called "wgBreakFrames" wouldn't execute the function. Second of all, I'm not really sure how that could be "used maliciously". If you're able to inject Javascript into the window context, you can already do whatever you like to the user's browser. So I'm not quite sure how this is supposed to "cause potential damage to the site". Remember there is alwayz someone who knows more than us out there --------------------------------- Be a PS3 game guru. Get your game face on with the latest PS3 news and previews at Yahoo! Games.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ________________________________________________________________________ Kostenlos: AOL eMail 2 GB Speicherplatz sowie erstklassiger Spam- und eMail Virenschutz. Sichern Sie sich Ihre persönliche eMail Adresse noch heute!
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Is OWASP vulnerable ??, (continued)
- Re: Is OWASP vulnerable ?? Valdis . Kletnieks (Mar 10)
- Re: Is OWASP vulnerable ?? Paul Schmehl (Mar 10)
- Re: Is OWASP vulnerable ?? Valdis . Kletnieks (Mar 10)
- Re: Is OWASP vulnerable ?? Paul Schmehl (Mar 10)
- Re: Is OWASP vulnerable ?? jf (Mar 10)
- Re: Is OWASP vulnerable ?? czino2 (Mar 11)
- Re: Is OWASP vulnerable ?? Michael Silk (Mar 11)
- Re: Is OWASP vulnerable ?? Valdis . Kletnieks (Mar 10)
- Re: Is OWASP vulnerable ?? Scarlet Pimpernel (Mar 10)
- Re: Is OWASP vulnerable ?? jf (Mar 10)
- Re: Is OWASP vulnerable ?? czino2 (Mar 11)