full-disclosure - Re: Gmail XSS?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 2 Jan 2007 01:20:19 +0200 (EET)
From: Juha-Matti Laurio <juha-matti.laurio@...ti.fi>
To: Denzity <denzity@...il.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: Gmail XSS?

According to this news it was fixed already:
http://blogs.zdnet.com/Google/?p=434

See a quote of Google Security Team

- Juha-Matti

Denzity <denzity@...il.com> wrote: 
>
> There's reports of a gmail xss in the wild that will steal someone's contact
> list and email if they website is visited while being logged in to gmail.
> 
> http://cyber-knowledge.net/blog/2007/01/01/gmail-vulnerable-to-contact-list-hijacking/
> 
> I can't find this on Bugtraq or any release. Anyone have any more info or
> a PoC?
>
> Thanks, Denzity.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/