2. Cross-site scripting (reflected)
3. Cookie without HttpOnly flag set
4. Cross-domain script include
Severity: | High |
Confidence: | Tentative |
Host: | http://help.aol.com |
Path: | /help/microsites/search |
GET /help/microsites/search Host: help.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close |
HTTP/1.1 200 OK Date: Tue, 08 Mar 2011 12:07:08 GMT Server: Apache Set-Cookie: JSESSIONID=2FA6AB8E6 Keep-Alive: timeout=15, max=80 Connection: Keep-Alive Content-Type: text/html;charset=UTF-8 Set-Cookie: NSC_ofxifmq-b-opjq*80 Content-Length: 31581 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <script type="text/jav ...[SNIP]... 97080&radios=False" onDragStart="fOnDragStart ...[SNIP]... |
GET /help/microsites/search Host: help.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close |
HTTP/1.1 200 OK Date: Tue, 08 Mar 2011 12:07:10 GMT Server: Apache Set-Cookie: JSESSIONID=00A5629C7 Keep-Alive: timeout=15, max=80 Connection: Keep-Alive Content-Type: text/html;charset=UTF-8 Set-Cookie: NSC_ofxifmq-b-opjq*80 Content-Length: 31376 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <script type="text/jav ...[SNIP]... |
Severity: | High |
Confidence: | Certain |
Host: | http://help.aol.com |
Path: | /help/microsites/search |
GET /help/microsites/search Host: help.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close |
HTTP/1.1 200 OK Date: Tue, 08 Mar 2011 12:07:05 GMT Server: Apache Set-Cookie: JSESSIONID=5EF09BF7C Keep-Alive: timeout=15, max=80 Connection: Keep-Alive Content-Type: text/html;charset=UTF-8 Set-Cookie: NSC_ofxifmq-b-opjq*80 Content-Length: 31386 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <script type="text/jav ...[SNIP]... <TextArea name="af4cc"><script>alert(1)< ...[SNIP]... |
Severity: | Low |
Confidence: | Firm |
Host: | http://help.aol.com |
Path: | /help/microsites/search |
GET /help/microsites/search Host: help.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close |
HTTP/1.1 200 OK Date: Tue, 08 Mar 2011 12:06:53 GMT Server: Apache Set-Cookie: JSESSIONID=223410D14 Keep-Alive: timeout=15, max=80 Connection: Keep-Alive Content-Type: text/html;charset=UTF-8 Set-Cookie: NSC_ofxifmq-b-opjq*80 Content-Length: 31283 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <script type="text/javascript" ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://help.aol.com |
Path: | /help/microsites/search |
GET /help/microsites/search Host: help.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close |
HTTP/1.1 200 OK Date: Tue, 08 Mar 2011 12:06:53 GMT Server: Apache Set-Cookie: JSESSIONID=223410D14 Keep-Alive: timeout=15, max=80 Connection: Keep-Alive Content-Type: text/html;charset=UTF-8 Set-Cookie: NSC_ofxifmq-b-opjq*80 Content-Length: 31283 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <script type="text/javascript" ...[SNIP]... <![endif]--> <script type="text/javascript" src="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://o.aolcdn.com <script type="text/javascript" src="http://o.aolcdn.com <script language="JavaScript1.1" src="http://o.aolcdn.com <script language="JavaScript1.1" src="http://o.aolcdn.com ...[SNIP]... <div class="searchEntry" style="display:none;float <script src="http://o.aolcdn.com <script src="http://o.aolcdn.com <SCRIPT src="http://o.aolcdn.com <SCRIPT src="http://o.aolcdn.com ...[SNIP]... </script> <script type="text/javascript" src="http://o.aolcdn.com ...[SNIP]... <!-- Footer HTML --> <script type="text/javascript" src="http://o.aolcdn.com ...[SNIP]... |