- From: TAKAGI, Hiromitsu <takagi@etl.go.jp>
- Date: Sat, 19 May 2001 04:58:40 -0400 (EDT)
- To: site-comments@w3.org
- Cc: takagi@etl.go.jp
I found a cross-site scripting vulnerability in the W3C public search engine. Accessing the following URL, the JavaScript code will be executed on the w3.org domain by the user's browser. http://search.w3.org/Public/cgi-bin/query?mss=simple&pg=q&what=web&filter=w3c&fmt=.&q=%3C%2FTITLE%3E%3CSCRIPT%3Ealert%28document.domain%29%3C%2FSCRIPT%3E For details about cross-site scripting vulnerability, please refer the following pages. http://www.microsoft.com/TechNet/security/crssite.asp http://www.cert.org/advisories/CA-2000-02.html Best regards, -- Hiromitsu Takagi Electrotechnical Laboratory http://www.etl.go.jp/~takagi/
Received on Monday, 21 May 2001 01:51:26 UTC