Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | [Full-Disclosure] Script Injection in Google Groups Beta |
|---|---|
| Date: | Fri, 17 Dec 2004 21:29:24 +0000 |
When I was testing Google Groups Beta (http://groups-beta.google.com/group/n3td3v) I found the script tags executed on the Google Groups site. This only seems to work while clicking on a reply thread, using the reply menu, featured on a given groups homepage, when an older thread gets a reply. If the thread reply you try to open has a script in it, then the script executes, instead of taking you to the reply to the thread you were attempting to view. An attacker can send a reply to a thread on Google Groups Beta with a carefully crafted script in it, to exploit Google Group Beta users! This is probably just the tip of the ice berg of something bigger, but I thought I better mention it before malicious users started exploiting people. Discovered today by n3td3v. Thanks, n3td3v. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Local versus remote security holes, Adam Shostack |
|---|---|
| Next by Date: | Re: DJB's students release 44 *nix software vulnerability advisories, Steven M. Christey |
| Previous by Thread: | MDKSA-2004:156 - Updated krb5 packages fix buffer overflow vulnerability, Mandrake Linux Security Team |
| Next by Thread: | [Full-Disclosure] Re: Script Injection in Google Groups Beta, n3td3v |
| Indexes: | [Date] [Thread] [Top] [All Lists] |