holy shit! you all are the biggest faggots i've ever seen!<br><br>
<div><span class="gmail_quote">On 8/10/06, <b class="gmail_sendername">Florian Weimer</b> <<a href="mailto:fw@deneb.enyo.de">fw@deneb.enyo.de</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">* pdp:<br><br>> 1. page that is controlled by the attacker, lets call it <a href="http://evil.com">evil.com
</a><br>> 2. border router vulnerable to XSS<br>> 3. user attending <a href="http://evil.com">evil.com</a><br><br>This has nothing to do with cross-site scripting attacks, it's an<br>entirely different vulnerability class called cross-site request
<br>forgery (CSRF). A lot of web applications are afffected.<br><br>Technically, this is a browser vulnerability, but you can't fix it<br>there as cross-site requests are too common in the real world.<br><br>_______________________________________________
<br>Full-Disclosure - We believe in it.<br>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/">
http://secunia.com/</a><br></blockquote></div><br>