Greasemonkey 0.3.3 - Multiple Remote Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/14336/info

Greasemonkey is susceptible to multiple remote information disclosure vulnerabilities. These issues are due to a design error allowing insecure JavaScript functions to be executed by remote Web sites.

The specified issues exist in the 'GM_xmlhttpRequest()', 'GM_setValue()', and 'GM_scripts()' functions.

Other GM_* functions also likely to be affected, but the exact functions are not known at this time.

These vulnerabilities allow remote attackers to retrieve the contents of arbitrary files, retrieve directory listings from arbitrary locations, and retrieve the contents of various private Greasemonkey data structures. This aids them in further attacks. 

http://diveintogreasemonkey.org/experiments/function-leak.html
http://diveintogreasemonkey.org/experiments/script-leak.html
http://diveintogreasemonkey.org/experiments/xmlhttprequest-leak.html
http://diveintogreasemonkey.org/experiments/localfile-leak.html