<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/MustLive Edition" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Коментарі для запису: Cross-Site Scripting уразливості в Mozilla, Internet Explorer, Opera та Chrome</title>
	<link>http://websecurity.com.ua/3275/</link>
	<description></description>
	<pubDate>Tue, 21 Apr 2026 09:10:45 +0000</pubDate>
	<generator>http://wordpress.org/?v=MustLive Edition</generator>

	<item>
		<title>від: MustLive</title>
		<link>http://websecurity.com.ua/3275/#comment-301169</link>
		<pubDate>Fri, 28 Aug 2009 12:43:40 +0000</pubDate>
		<guid>http://websecurity.com.ua/3275/#comment-301169</guid>
					<description>Як я написав в своїй статті &lt;a href="/3376/" rel="nofollow"&gt;Cross-Site Scripting атаки через редиректори&lt;/a&gt;, дана уразливість має місце також в браузерах Google Chrome 2.0.172.28, 2.0.172.37 та 3.0.193.2 Beta, QtWeb 3.0 Build 001 та 3.0 Build 003, Safari 4.0.3, Opera 10.00 Beta 3 Build 1699, SeaMonkey 1.1.17, Firefox 3.6 a1 pre та Maxthon 3 Alpha (3.0.0.145) з Ultramode.</description>
		<content:encoded><![CDATA[<p>Як я написав в своїй статті <a href="/3376/" rel="nofollow">Cross-Site Scripting атаки через редиректори</a>, дана уразливість має місце також в браузерах Google Chrome 2.0.172.28, 2.0.172.37 та 3.0.193.2 Beta, QtWeb 3.0 Build 001 та 3.0 Build 003, Safari 4.0.3, Opera 10.00 Beta 3 Build 1699, SeaMonkey 1.1.17, Firefox 3.6 a1 pre та Maxthon 3 Alpha (3.0.0.145) з Ultramode.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: MustLive</title>
		<link>http://websecurity.com.ua/3275/#comment-299536</link>
		<pubDate>Sun, 26 Jul 2009 16:39:15 +0000</pubDate>
		<guid>http://websecurity.com.ua/3275/#comment-299536</guid>
					<description>Як я сьогодні перевірив, Internet Explorer 7 (7.0.6000.16473) не уразливий. Так що уразливі лише IE6 та попередні версії.</description>
		<content:encoded><![CDATA[<p>Як я сьогодні перевірив, Internet Explorer 7 (7.0.6000.16473) не уразливий. Так що уразливі лише IE6 та попередні версії.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: MustLive</title>
		<link>http://websecurity.com.ua/3275/#comment-297631</link>
		<pubDate>Sat, 04 Jul 2009 15:06:36 +0000</pubDate>
		<guid>http://websecurity.com.ua/3275/#comment-297631</guid>
					<description>My main idea of this research is that both location and refresh redirectors (to javascript URIs) must be blocked in browsers (in all browsers). If location-header redirectors not allow such JS code execution, then refresh-header redirectors must do the same. They both must have the same behaviour.</description>
		<content:encoded><![CDATA[<p>My main idea of this research is that both location and refresh redirectors (to javascript URIs) must be blocked in browsers (in all browsers). If location-header redirectors not allow such JS code execution, then refresh-header redirectors must do the same. They both must have the same behaviour.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: MustLive</title>
		<link>http://websecurity.com.ua/3275/#comment-297628</link>
		<pubDate>Sat, 04 Jul 2009 13:49:29 +0000</pubDate>
		<guid>http://websecurity.com.ua/3275/#comment-297628</guid>
					<description>&lt;strong&gt;Inferno&lt;/strong&gt;

You are welcome.

For translating of my site from Ukrainian to English use &lt;a href="http://translate.google.com" rel="nofollow"&gt;Google Translate&lt;/a&gt; service ;-).

&lt;blockquote&gt;Is this issue different from the one discussed by RSnake here&lt;/blockquote&gt;
I read that RSnake's post and even noted for myself to write about it, but just forgot about it for such long time.

Inferno, this is the same issue, but we wrote about it in different way. RSnake told about hole in Firefox only (yes, old Mozilla is vulnerable too in my researches and his script), but I was talking about holes in all browsers (which I had), from which only in Firefox 3.0.9 this vulnerability was fixed.

And I'm talking about 0-timed (non-timed) redirect - it's main difference in our researches. And if RSnake told that it's limited and not so interesting, then I'm talking that it's XSS vector! And I tested it in XSS hole which I found in one webapp which is very widespread (and so this XSS hole is also very widespread).</description>
		<content:encoded><![CDATA[<p><strong>Inferno</strong></p>
<p>You are welcome.</p>
<p>For translating of my site from Ukrainian to English use <a href="http://translate.google.com" rel="nofollow">Google Translate</a> service <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /> .</p>
<blockquote><p>Is this issue different from the one discussed by RSnake here</p></blockquote>
<p>I read that RSnake&#8217;s post and even noted for myself to write about it, but just forgot about it for such long time.</p>
<p>Inferno, this is the same issue, but we wrote about it in different way. RSnake told about hole in Firefox only (yes, old Mozilla is vulnerable too in my researches and his script), but I was talking about holes in all browsers (which I had), from which only in Firefox 3.0.9 this vulnerability was fixed.</p>
<p>And I&#8217;m talking about 0-timed (non-timed) redirect - it&#8217;s main difference in our researches. And if RSnake told that it&#8217;s limited and not so interesting, then I&#8217;m talking that it&#8217;s XSS vector! And I tested it in XSS hole which I found in one webapp which is very widespread (and so this XSS hole is also very widespread).
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: Inferno</title>
		<link>http://websecurity.com.ua/3275/#comment-297602</link>
		<pubDate>Sat, 04 Jul 2009 05:33:40 +0000</pubDate>
		<guid>http://websecurity.com.ua/3275/#comment-297602</guid>
					<description>Hi MustLive,

Is this issue different from the one discussed by RSnake here - http://ha.ckers.org/blog/20070309/firefox-header-redirection-javascript-execution/

Anyways, nice site with great research. Will be good to have some plugin for translation.....

Thanks,
Inferno</description>
		<content:encoded><![CDATA[<p>Hi MustLive,</p>
<p>Is this issue different from the one discussed by RSnake here - <a href="http://ha.ckers.org/blog/20070309/firefox-header-redirection-javascript-execution/" rel="nofollow">http://ha.ckers.org/blog/20070309/firefox-header-redirection-javascript-execution/</a></p>
<p>Anyways, nice site with great research. Will be good to have some plugin for translation&#8230;..</p>
<p>Thanks,<br />
Inferno
</p>
]]></content:encoded>
				</item>
</channel>
</rss>
