[VulnWatch] administrivia: cross-site tracing

There's been a lot of back and forth about the recent WhiteHat Security XST bug. Sensationalism aside, the fact still remains: 1. Access to cookies, particularly the 'httponly' add-on by IE, is limited by browser security restrictions. And I don't recall any browser being able to legitimately...

DEBIAN-CVE-2002-1335

Cross-site scripting XSS vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies...

XSS bug in PHPNuke 6.0

Vulnerable systems: PHPNuke 6.0 & mabey all Exploit: 1- go to http://traget/modules.php?name=Downloads&dop=search 2- put in form search this code : Scriptjavascript:alertdocument.cookie/Script 3- click "Search" without "" you can't use it an URL like this http://traget/modules.php?...

Secure cookie access in Knoqueror

Cookie with secure flag may be sent via unsecured channel...

Mozilla 0.9.x/1.0 - JavaScript URL Host Spoofing Arbitrary Cookie Access

source: https://www.securityfocus.com/bid/5293/info Mozilla is an open source web browser available for a number of platforms, including Microsoft Windows and Linux. An issue has been reported in the Mozilla web browser which may allow script code to access cookie data associated with arbitrary...

Mozilla 0.9.x1.0 - JavaScript URL Host Spoofing Arbitrary Cookie Access

Mozilla 0.9.x1.0 - JavaScript URL Host Spoofing Arbitrary Cookie Access source: https://www.securityfocus.com/bid/5293/info Mozilla is an open source web browser available for a number of platforms, including Microsoft Windows and Linux. An issue has been reported in the Mozilla web browser which...

Cookie access via res:\\ and about:\\ in Microsoft Internet Explorer

It's possible to use about: and res: URl to execute javascript in context of any page and local machine...

Opera 5.05.1 - Same Origin Policy Circumvention

Opera 5.05.1 - Same Origin Policy Circumvention source: https://www.securityfocus.com/bid/3553/info Opera is a popular, freely available web browser that is supported across many different platforms. Opera is prone to an issue which may allow for the execution of script code across domains,...

Microsoft IE cookies readable via about: URLS

Microsoft Internet Explorer has a vulnerability which allows a malicious website to access any cookie in the browser's memory or those stored on disk. Cookies are used by web sites for storing preferences, statistics and tracking users, but also for storing more sensitive information such as...

SECURITY.NNOV: accessing cookies via ftp

Hello bugtraq, Article below describes a vulnerability that can be treated as either software vulnerability or specific server configuration problem depending on your point of view. Many servers on Internet are affected by this problem though. Topic: accessing cookies via ftp Affected Software: a...

CVE-2000-0439

Internet Explorer 4.0 and 5.0 allows a malicious web site to obtain client cookies from another domain by including that domain name and escaped characters in a URL, aka the "Unauthorized Cookie Access" vulnerability...

CVE-2000-0439

Vulnerability: Internet Explorer 4.0/5.0. Issue: malicious site can obtain cookies from another domain by embedding that domain name with escaped characters in a URL (Unauthorized Cookie Access). Root cause: cross-domain cookie access via crafted URL. Impact: potential leakage of cookies across d...

Security Bulletin (MS00-033)

Microsoft Security Bulletin MS00-033 - -------------------------------------- Patch Available for "Frame Domain Verification", "Unauthorized Cookie Access", and "Malformed Component Attribute" Vulnerabilities Originally Posted: May 17, 2000 Summary ======= Microsoft has released a comprehensive...

CVE-2000-0439

Internet Explorer 4.0 and 5.0 allows a malicious web site to obtain client cookies from another domain by including that domain name and escaped characters in a URL, aka the "Unauthorized Cookie Access" vulnerability...