Risks
Vulnerabilities
Browse by
Mail.com Cross Site Scripting Vulnerability
04 January 2002
Bookmark and Share
----------------------------------------------
Mail.com Cross Site Scripting Vulnerability
Ministry-of-Peace - www.ministryofpeace.co.uk
----------------------------------------------

SYNOPSIS

Mail.com offers free webmail services, which are used by tens of thousands of people around the world. The site suffers from a CSS vulnerability, giving a malicious user the ability to view the site cookies of any user currently logged in.

IMPACT

If a malicious user can get the mail.com user to follow a simple link, then they can grab that users mail.com cookies and possibly use them to authenticate as that user.

WORKING EXAMPLE

Log into your mail.com account, and then go to:

http://mymail.mail.com/scripts/common/forgotpasswd.cgi?login=
<p><script>document.writeln(document.cookie)</
script></p>

CREDITS

Vulnerability discovered by Digital Shadow.

INFO

Security Advisory #03
Published: 03rd January 2002




Spotlight

Why vulnerability disclosure shouldn’t be a marketing tool

Brian Honan, CEO at BH Consulting, talks about a recent vulnerability disclosure trend – a trend that he believes may ultimately cause more harm than good: security vendors using vulnerability disclosure as a marketing tool with the goal of enhancing their company’s bottom line.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Thu, Jul 2nd
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //