CVE-2007-1085

Description

Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, and possibly gain full access to the system, by using an XSS vulnerability in google.com to extract the signature for the internal web server, then calling the "under" parameter in Advanced Search with the proper signature.

References

http://www.watchfire.com/resources/Overtaking-Google-Desktop.pdf

http://www.securitytracker.com/id?1017686

http://www.securityfocus.com/archive/1/460928/100/0/threaded

http://www.securityfocus.com/archive/1/460735/100/0/threaded

http://www.kb.cert.org/vuls/id/615857

http://securityreason.com/securityalert/2301

http://osvdb.org/33483

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3