Other nomination
Expect Header Injection Via Flash
Follow-up on Amit Klein's Expect header injection via Flash, reporting that Secunia's test tool shows a large fraction of major sites affected. Any site echoing the Expect header lets an attacker-supplied movie run script in its origin, enabling cookie theft, page scraping and XSS proxying even where the site has no XSS of its own.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.