Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Berend-Jan Wever (skylinededup.tudelft.nl)
Date: Fri Jan 14 2005 - 03:33:43 CST
Internet Explorer allows webpages on a remote server to load scripts from the local harddisk. These scripts get run in the remote server's security zone. This is not so much cross-site scripting but what I will call "cross-site loading" for now. Cross-site loading is not a new problem, a number of these bugs have been found already, most of which have not been fixed yet, even though the problem is over two years old now.
Demo and example:
(I also added demos and examples for two other old, known and unfixed cross-site loading problems).
FireFox does not allow any cross-site loading as far as I could tell, all three demo's do not work on it for that matter.
IRC: SkyLined in #SkyLined on EFNET
PGP: key ID 0x48479882
Full-Disclosure - We believe in it.