full-disclosure - Re: nVidia.com [Url Redirection flaw]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5e9568cb0903252209w7a495f50taa980ab9b90ff768@mail.gmail.com>
Date: Thu, 26 Mar 2009 01:09:38 -0400
From: Rubén Camarero <rjcamarero@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: nVidia.com [Url Redirection flaw]

_You_ are two dim to imagine that this issue is more like a bug than a
vulnerability. If _you_ did try to imagine it, your head would probably
explode and xssme would ooze out.

On Thu, Mar 26, 2009 at 12:42 AM, Nick FitzGerald
<nick@...us-l.demon.co.uk>wrote:

> Rubén Camarero wrote:
>
> > What great references. Owasp isn't the king of vulnerability information,
> of
> > course a website named XSSed is going to count this as super serious, and
> > while I respect Insecure.. these days, people have exploited web bugs to
> > their max (and I'm waiting for more), but they aren't directly serious.
> > DIRECTLY is the key word.
>
> No, but just because this kind of vulnerability is "only" indirectly
> serious dosen't mean that they aren't serious.
>
> Just because _you_ are too dim to imagine a way that someone can profit
> significantly from exploiting this does not mean that there are not such
> methods, NOR that use of such exploits won't "damage" nVidia.
>
> Whether nVidia (and others affected by so many similar vulnerabilities)
> will see this and decide to take action is what really matters.  In this
> regard, I certainly hope that you do not work for, or consult with, or
> otherwise represent the view of nVidia on this issue.
>
>
> Regards,
>
> Nick FitzGerald
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



-- 
Rubén Camarero
CCNA, CISSP

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/