lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20020830054637.GA9110@SDF.LONESTAR.ORG> From: colt45 at sdf.lonestar.org (Colt Peacemaker) Subject: iName/Mail.com security holes opens door to millions of e-mail accounts >>> AGT (Andrew G. Tereschenko) writes: AGT> It takes for me 6 minutes to invent another example of this bug. AGT> Not a 100% result, expected ~30%. AGT> It's an extremly easy to cut navigation items from down of page AGT> by using unclosed comments. AGT> Inserting own (linked to evil host) is a one minute task. Heh. Posting on full-disclosure seems to have set the cat among the pigeons there ... AFAICT they seem to have disabled a lot of other stuff over the last 12 hours or so (javascript for example). --cp -- Colt Peacemaker (colt45@....lonestar.org)
Powered by blists - more mailing lists