1. Cross-site scripting (reflected)
2. Cross-domain Referer leakage
3. Content type is not specified
Severity: | High |
Confidence: | Certain |
Host: | http://ads.bluelithium |
Path: | /st |
GET /st?ad_type=iframe&ad Host: ads.bluelithium.com Proxy-Connection: keep-alive Referer: http://www.pandora.com Accept: application/xml User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Date: Sun, 09 Jan 2011 02:02:46 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control: no-store Last-Modified: Sun, 09 Jan 2011 02:02:46 GMT Pragma: no-cache Content-Length: 5050 Age: 0 Proxy-Connection: close <html><head></head><body> ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://ads.bluelithium |
Path: | /st |
GET /st?ad_type=iframe&ad Host: ads.bluelithium.com Proxy-Connection: keep-alive Referer: http://www.pandora.com Accept: application/xml User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Date: Sun, 09 Jan 2011 01:22:56 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control: no-store Last-Modified: Sun, 09 Jan 2011 01:22:56 GMT Pragma: no-cache Content-Length: 4957 Age: 0 Proxy-Connection: close <html><head></head><body> ...[SNIP]... </noscript><img src="http://content ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://ads.bluelithium |
Path: | /st |
GET /st?ad_type=iframe&ad Host: ads.bluelithium.com Proxy-Connection: keep-alive Referer: http://www.pandora.com Accept: application/xml User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Date: Sun, 09 Jan 2011 01:22:56 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control: no-store Last-Modified: Sun, 09 Jan 2011 01:22:56 GMT Pragma: no-cache Content-Length: 4957 Age: 0 Proxy-Connection: close <html><head></head><body> ...[SNIP]... |