full-disclosure - Re: [0 Day] XSS Persistent in Blogspot of Google

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 27 Jan 2013 11:17:51 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: elfius@...il.com
Cc: ANTRAX <antrax.bt@...il.com>, el-brujo@...acker.net, vuln@...unia.com,
	submissions@...ketstormsecurity.com, submit@...ecurity.com,
	full-disclosure@...ts.grok.org.uk, mr.inj3ct0r@...il.com,
	vuldb@...urityfocus.com, Hispabyte HQH <fdkaos2000@...oo.es>
Subject: Re: [0 Day] XSS Persistent in Blogspot of Google

>
> OGMMM WTFF 0DAY XSS
> Sorry, getting a bit tired of these.

Well, the world is changing. You can probably do a lot more direct damage
with a (legit) XSS in a high-value site than with a local privilege
escalation in sudo.

XSS reports are less actionable for the average reader, but full disclosure
is probably still beneficial, in that it provides data points about the
types of flaws a particular vendor happens to have, and the speed and
quality of the deployed fixes.

Of course, many of the XSS reports in knorr.com and similarly exciting
destinations are zzzzzzzzzz...

/mz

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/