[WEB SECURITY] Yahoo Multiple Vulnerabilities Authentication Bypass, Session Binding, Cookie Encoding Security Weakness, Cross-Site Scripting and URL Redirection

[Rajesh Sethumadhavan <rajesh.sethumadhavan@xxxxxxxxx>]

--0-775780869-1151041985=:66173
Content-Type: multipart/alternative; boundary="0-1553008202-1151041985=:66173"

--0-1553008202-1151041985=:66173
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit



 __________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
--0-1553008202-1151041985=:66173
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

<br><p>&#32;__________________________________________________<br>Do You Yahoo!?<br>Tired of spam?  Yahoo! Mail has the best spam protection around <br>http://mail.yahoo.com 
--0-1553008202-1151041985=:66173--
--0-775780869-1151041985=:66173
Content-Type: application/msword; name="XD100001.rtf"
Content-Transfer-Encoding: base64
Content-Description: 3535778892-XD100001.rtf
Content-Disposition: attachment; filename="XD100001.rtf"

e1xydGYxXGFuc2lcZGVmZjB7XGZvbnR0Ymx7XGYwXGZuaWxcZmNoYXJzZXQw
IENvdXJpZXIgTmV3O319DQp7XCpcZ2VuZXJhdG9yIE1zZnRlZGl0IDUuNDEu
MTUuMTUwNzt9XHZpZXdraW5kNFx1YzFccGFyZFxsYW5nMTAzM1xmMFxmczIw
IFlhaG9vIE11bHRpcGxlIFZ1bG5lcmFiaWxpdGllcyAoQXV0aGVudGljYXRp
b24gQnlwYXNzLCBTZXNzaW9uIEJpbmRpbmcsIENvb2tpZVxwYXINCkVuY29k
aW5nIFNlY3VyaXR5IFdlYWtuZXNzLCBDcm9zcy1TaXRlIFNjcmlwdGluZyBh
bmQgVVJMIFJlZGlyZWN0aW9uKVxwYXINClxwYXINCiMjIyMjIyMjIyMjIyMj
IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMjIyMjIyMjIyMjIyNccGFyDQpccGFyDQpYRGlzY2xvc2UgQWR2aXNv
cnkgICAgICA6IFhEMTAwMDAxXHBhcg0KQWR2aXNvcnkgUmVsZWFzZWRcdGFi
ICAgICAgIDogMjB0aCBKdW5lIDA2XHBhcg0KQ3JlZGl0ICAgICAgICAgICAg
ICAgICAgOiBSYWplc2ggU2V0aHVtYWRoYXZhblxwYXINClxwYXINCkNsYXNz
XHRhYiAgICAgICAgICAgICAgICAgICA6IEF1dGhlbnRpY2F0aW9uIEJ5cGFz
c1xwYXINCiAgICAgICAgICAgICAgICAgICAgICAgICAgU2Vzc2lvbiBCaW5k
aW5nIFZ1bG5lcmFiaWxpdHlccGFyDQogICAgICAgICAgICAgICAgICAgICAg
ICAgIENvb2tpZXMgRW5jb2RpbmcgU2VjdXJpdHkgV2Vha25lc3NccGFyDQog
ICAgICAgICAgICAgICAgICAgICAgICAgIENyb3NzLVNpdGUgU2NyaXB0aW5n
XHBhcg0KICAgICAgICAgICAgICAgICAgICAgICAgICBVUkwgcmVkaXJlY3Rp
b25ccGFyDQpTZXZlcml0eSAgICAgICAgICAgICAgICA6IE1lZGl1bVxwYXIN
ClNvbHV0aW9uIFN0YXR1cyAgICAgICAgIDogVW5wYXRjaGVkXHBhcg0KVmVu
ZG9yICAgICAgICAgICAgICAgICAgOiBZYWhvb1xwYXINCkFmZmVjdGVkIGFw
cGxpY2F0aW9ucyAgIDogWWFob28gbXVsdGlwbGUgd2ViLWJhc2VkIHNlcnZp
Y2VzXHBhcg0KXHBhcg0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
I1xwYXINClxwYXINClxwYXINCk92ZXJ2aWV3OlxwYXINCllhaG9vISBJbmMu
IGlzIGFuIEFtZXJpY2FuIGNvbXB1dGVyIHNlcnZpY2VzIGNvbXBhbnkgd2l0
aCBhIG1pc3Npb24gdG9ccGFyDQoiYmUgdGhlIG1vc3QgZXNzZW50aWFsIGds
b2JhbCBJbnRlcm5ldCBzZXJ2aWNlIGZvciBjb25zdW1lcnMgYW5kXHBhcg0K
YnVzaW5lc3NlcyIuIEl0IG9wZXJhdGVzIGFuIEludGVybmV0IHBvcnRhbCwg
aW5jbHVkaW5nIHRoZSBwb3B1bGFyXHBhcg0KWWFob28hIE1haWwuQWNjb3Jk
aW5nIHRvIFdlYiB0cmVuZHMgWWFob28hIGlzIHRoZSBtb3N0IHZpc2l0ZWRc
cGFyDQp3ZWJzaXRlIG9uIHRoZSBJbnRlcm5ldCB0b2RheSB3aXRoIG1vcmUg
dGhhbiA0MDAgbWlsbGlvbiB1bmlxdWUgdXNlcnMuXHBhcg0KVGhlIGdsb2Jh
bCBuZXR3b3JrIG9mIFlhaG9vISB3ZWJzaXRlcyByZWNlaXZlZCAzLjQgYmls
bGlvbiBwYWdlIHZpZXdzXHBhcg0KcGVyIGRheSBvbiBhdmVyYWdlIGFzIG9m
IE9jdG9iZXIgMjAwNS5ccGFyDQpccGFyDQpWYXJpb3VzIFlhaG9vISBzZXJ2
aWNlcyBhcmUgdnVsbmVyYWJsZSB0byBhdXRoZW50aWNhdGlvbiBieXBhc3Ms
XHBhcg0Kc2Vzc2lvbiBiaW5kaW5nLCB3ZWFrIGNvb2tpZSBlbmNvZGluZywg
Y3Jvc3Mtc2l0ZSBzY3JpcHRpbmcgZmlsZVxwYXINCmluY2x1c2lvbiBhbmQg
dXJsIHJlZGlyZWN0aW9uIHZ1bG5lcmFiaWxpdGllcywgd2hpY2ggaXMgY2F1
c2VkIFxwYXINCmR1ZSB0byBpbXByb3BlciB2YWxpZGF0aW9uIG9mIHVzZXIt
c3VwcGxpZWQgaW5wdXRzLiBccGFyDQpccGFyDQpEZXNjcmlwdGlvbjpccGFy
DQpNdWx0aXBsZSB2dWxuZXJhYmlsaXRpZXMgZXhpc3QgaW4gdmFyaW91cyBZ
YWhvbyBzZXJ2aWNlcy5ccGFyDQogXHBhcg0KXHBhcg0KMS4gQXV0aGVudGlj
YXRpb24gQnlwYXNzIGFuZCBTZXNzaW9uIEJpbmRpbmcgVnVsbmVyYWJpbGl0
eS5ccGFyDQogICBBIG1hbGljaW91cyB1c2VyIGNhbiBsb2cgb24gdG8gdGhl
IHlhaG9vIHdpdGhvdXQgc3VibWl0dGluZyB0aGVccGFyDQogICB1c2VybmFt
ZSBhbmQgcGFzc3dvcmQgYnkgY29uc3RydWN0aW5nIGEgbWFsaWNpb3VzIFVS
TCB1c2luZ1xwYXINCiAgIGNvb2tpZXMuIFxwYXINClxwYXINCiAgIFNhbWUg
c2Vzc2lvbiAoVVJMKSBjYW4gYmUgdXNlZCB0byBsb2dpbiBtdWx0aXBsZSB0
aW1lcyBmcm9tXHBhcg0KICAgbXVsdGlwbGUgSVAgYWRkcmVzcyBsZWFkaW5n
IHRvIHNlc3Npb24gYmluZGluZyB2dWxuZXJhYmlsaXR5LlxwYXINClxwYXIN
CiAgIFBPQzogKFVQREFURUQgaW4gT3JpZ2luYWwgU2l0ZSlccGFyDQogIFxw
YXINCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXHBhcg0KICBccGFy
DQpodHRwOi8vbXNnLmVkaXQueWFob28uY29tL2NvbmZpZy9yZXNldF9jb29r
aWVzPyYueT1ZPXY9MSUyNm49MGt2Z3ZndjNxbGYxMVxwYXINCiUyNmw9aTQy
Lmo0aWovbyYudD1UPXNrPURBQW5nOTdlaC9zbXpTJTI2ZD1jMndCVGxSVk1V
RlVTVEZOVkVsNFRYcG5OVTVFVlMwXHBhcg0KQllRRlJRVVVCZEdsd0FWTlFa
SGh2UWdGNmVnRjRWakZ0UlVKblYwRS0mLmRvbmU9aHR0cCUzYS8vbWFpbC55
YWhvby5jb21ccGFyDQogIFxwYXINCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tXHBhcg0KICBccGFyDQpodHRwOi8vbXNnLmVkaXQueWFob28uY29t
L2NvbmZpZy9yZXNldF9jb29raWVzPyYueT1ZPXY9MSUyNm49MGt2Z3ZndjNx
bGYxMVxwYXINCiUyNmw9aTQyLmo0aWovbyUyNnA9bTJndnZpbmQxMzAwMDcw
MCYudD1UPXNrPURBQW5nOTdlaC9zbXpTJTI2ZD1jMndCVGxSVk1VXHBhcg0K
RlVTVEZOVkVsNFRYcG5OVTVFVlMwQllRRlJRVVVCZEdsd0FWTlFaSGh2UWdG
NmVnRjRWakZ0UlVKblYwRS0mLmRvbmU9aHR0cFxwYXINCiUzYS8vbWFpbC55
YWhvby5jb21ccGFyDQogIFxwYXINCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tXHBhcg0KXHBhcg0KICAgV2hlcmUgaW4gInNrIiAmICJkIiBpcyBz
ZXNzaW9uXHBhcg0KXHBhcg0KICAgU2NyZWVuc2hvdDpccGFyDQogICBodHRw
Oi8vd3d3LnhkaXNjbG9zZS5jb20vWWFob29fQXV0aF9CeXBhc3MucG5nXHBh
cg0KXHBhcg0KXHBhcg0KMi4gQ29va2llIEVuY29kaW5nIFNlY3VyaXR5IFdl
YWtuZXNzXHBhcg0KICAgSW1wbGVtZW50YXRpb24gb2YgY29va2llcyBpbiB5
YWhvbyBpcyB0b28gd2VhayB0aGF0IGl0IGNhbiBiZVxwYXINCiAgIGRlY29k
ZWQgZWFzaWx5LiBBIG1hbGljaW91cyBhdHRhY2tlciBjYW4gZWFzaWx5IGNv
bGxlY3QgbWFueVxwYXINCiAgIHBlcnNvbmFsIGluZm9ybWF0aW9uIHVzaW5n
IGNvb2tpZXMgbGlrZSB5ZWFyIG9mIGJpcnRoLCB6aXBjb2RlLFxwYXINCiAg
IGNvdW50cnkgYW5kIG5hbWUgd2hpY2ggY2FuIGJlIHVzZWQgdG8gZ2V0IHBh
c3N3b3JkIGZyb20gInlhaG9vXHBhcg0KICAgZm9yZ290IHBhc3N3b3JkIi5c
cGFyDQpccGFyDQogICBXaGVyZSBpbiBccGFyDQogICBzayAmIGQgaXMgc2Vz
c2lvblxwYXINCiAgIG4gaXMgcGFzc3dvcmRccGFyDQogICBsIGlzIHVzZXJu
YW1lXHBhcg0KICAgcCBpcyBjb3VudHJ5LCB5ZWFyIG9mIGJpcnRoLCBnZW5k
ZXIgYW5kIG1vcmVccGFyDQogICBiIGlzIGNvb2tpZXMgY3JlYXRlZFxwYXIN
CiAgIGxnIGlzIGxhbmd1YWdlXHBhcg0KICAgaW50bCBpcyBpbnRlcm5hdGlv
bmFsIGxhbmd1YWdlXHBhcg0KICAgaXogaXMgemlwY29kZVxwYXINCiAgIGpi
IGlzIEluZHVzdHJ5IGFuZCB0aXRsZVxwYXINClxwYXINCiAgIFBPQyBTY3Jl
ZW5zaG90OlxwYXINCiAgIGh0dHA6Ly93d3cueGRpc2Nsb3NlLmNvbS9ZYWhv
b19Db29raWVfRW5jb2RpbmcucG5nXHBhcg0KXHBhcg0KMy4gQ3Jvc3MtU2l0
ZSBTY3JpcHRpbmcuXHBhcg0KICAgVGhpcyB2dWxuZXJhYmlsaXR5IGlzIHJl
c3VsdGVkIGZyb20gdGhlIGZhaWx1cmUgb2YgWWFob28hIGZpbHRlcmluZ1xw
YXINCiAgIGVuZ2luZSB0byBibG9jayBjcmV0aW4gdXNlci1zdXBwbGllZCBp
bnB1dHNccGFyDQpccGFyDQogICBhKSBZYWhvbyBDYWxlbmRhciBTZXJ2aWNl
IFhTU1xwYXINClx0YWIgVGhlIGZsYXdzIGFyZSBkdWUgdG8gaW1wcm9wZXIg
c2FuaXRpemF0aW9uIG9mIGlucHV0cyBwYXNzZWQgdG9ccGFyDQpcdGFiICJM
b2NhdGlvbiIsICJBZGRyZXNzIiwgIlN0cmVldCIgYW5kICJQaG9uZSIuXHBh
cg0KXHBhcg0KXHRhYiA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxwYXINClx0YWIg
VGhpcyBldmVudCByZXBlYXRzIGV2ZXJ5IGRheS5ccGFyDQpcdGFiIDwvZm9u
dD48YnI+XHBhcg0KXHRhYiA8Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0tMT5c
cGFyDQpcdGFiIDxiPkV2ZW50IExvY2F0aW9uPC9iPjogPHNjcmlwdD5hbGVy
dCgnTG9jYXRpb24nKTwvc2NyaXB0PlxwYXINClx0YWIgPGJyPjxiPlN0cmVl
dDwvYj46IDxzY3JpcHQ+YWxlcnQoJ0FkZHJlc3MnKTwvc2NyaXB0PlxwYXIN
Clx0YWIgPGJyPjxiPkNpdHksIFN0YXRlLCBaaXA8L2I+OiA8c2NyaXB0PmFs
ZXJ0KCdTdHJlZXQnKTwvc2NyaXB0PlxwYXINClx0YWIgPGJyPjxiPlBob25l
PC9iPjogPHNjcmlwdD5hbGVydCgnUGhvbmUnKTwvc2NyaXB0PlxwYXINClx0
YWIgPC9mb250Pjxicj5cdGFiICAgICAgICBcdGFiXHRhYiAgICAgICAgXHBh
cg0KXHRhYiA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxwYXINClx0YWJccGFyDQpc
dGFiIFNjcmVlbnNob3Q6XHBhcg0KXHRhYiBodHRwOi8vd3d3LnhkaXNjbG9z
ZS5jb20vWFNTX0NhbGVuZGVyX0FkZHJlc3MucG5nXHBhcg0KXHRhYiBodHRw
Oi8vd3d3LnhkaXNjbG9zZS5jb20vWFNTX0NhbGVuZGVyX1Bob25lLnBuZ1xw
YXINClx0YWIgaHR0cDovL3d3dy54ZGlzY2xvc2UuY29tL1hTU19DYWxlbmRl
cl9sb2NhdGlvbi5wbmdccGFyDQpcdGFiIGh0dHA6Ly93d3cueGRpc2Nsb3Nl
LmNvbS9YU1NfQ2FsZW5kZXJfU3RyZWV0LnBuZ1xwYXINClxwYXINClxwYXIN
CiAgIGIpIFlhaG9vIE9wdGlvbnMgTWFpbCBBY2NvdW50IFhTU1xwYXINClx0
YWIgVGhlIGZsYXdzIGFyZSBkdWUgdG8gaW1wcm9wZXIgc2FuaXRpemF0aW9u
IG9mIGlucHV0cyBwYXNzZWQgdG9ccGFyDQogICAgICAgICJOYW1lIiBhbmQg
IlJlcGx5IHRvIiBwYXJhbWV0ZXJzLlxwYXINClxwYXINClxwYXINClx0YWIg
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT1ccGFyDQpcdGFiIDx0ciB2YWxpZ249InRv
cCI+XHBhcg0KXHRhYiA8dGQ+TmFtZTo8L3RkPlxwYXINClx0YWIgPHRkPjxz
Y3JpcHQ+YWxlcnQoJ05hbWUnKTwvc2NyaXB0PjwvdGQ+XHBhcg0KXHRhYiA8
L3RyPlxwYXINClxwYXINClx0YWIgPHRyIHZhbGlnbj0idG9wIj5ccGFyDQpc
dGFiIDx0ZD5FbWFpbDo8L3RkPlxwYXINClx0YWIgPHRkPnNlYy50ZXN0QHlh
aG9vLmNvbTwvdGQ+XHBhcg0KXHRhYiA8L3RyPlx0YWJccGFyDQpcdGFiIDx0
ciB2YWxpZ249InRvcCI+XHBhcg0KXHRhYiA8dGQ+UmVwbHktVG86PC90ZD5c
dGFiXHBhcg0KXHRhYiA8dGQ+PHNjcmlwdD5hbGVydCgnUmVwbHknKTwvc2Ny
aXB0PkB5YWguY29tPC90ZD5ccGFyDQpcdGFiIDwvdHI+XHBhcg0KXHRhYiA9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PVxwYXINClxwYXINClx0YWIgU2NyZWVuc2hv
dDpccGFyDQpcdGFiIGh0dHA6Ly93d3cueGRpc2Nsb3NlLmNvbS9YU1NfTWFp
bF9BY2NvdW50X05hbWUucG5nXHBhcg0KXHRhYiBodHRwOi8vd3d3LnhkaXNj
bG9zZS5jb20vWFNTX01haWxfQWNjb3VudF9SZXBseS5wbmdccGFyDQpccGFy
DQpccGFyDQogICBjKSBZYWhvbyBPcHRpb25zIEZpbHRlciBYU1MuXHBhcg0K
XHRhYiBUaGUgZmxhd3MgYXJlIGR1ZSB0byBpbXByb3BlciBzYW5pdGl6YXRp
b24gb2YgaW5wdXRzIHBhc3NlZCB0b1xwYXINCiAgICAgICAgIkZyb20iIGFu
ZCAiVG8iIHBhcmFtZXRlcnNccGFyDQpcdGFiID09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09XHBhcg0KXHRhYiA8Yj5Gcm9tPC9iPlx0YWIgY29udGFpbnNccGFyDQpc
dGFiICI8Yj48c2NyaXB0PmFsZXJ0KCdGcm9tJyk8L3NjcmlwdD5AeWFob28u
Y29tPC9iPiJccGFyDQpcdGFiIDxicj5ccGFyDQpcdGFiICZuYnNwOyZuYnNw
OyZuYnNwOzxiPlRvL0NDPC9iPiBjb250YWluc1xwYXINClx0YWIgIjxiPjxz
Y3JpcHQ+YWxlcnQoJ1RvJyk8L3NjcmlwdD5AeWFob28uY29tPC9iPiJccGFy
DQpcdGFiIDxicj5ccGFyDQpcdGFiID09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XHBh
cg0KXHBhcg0KXHRhYiBTY3JlZW5zaG90OlxwYXINClx0YWIgaHR0cDovL3d3
dy54ZGlzY2xvc2UuY29tL1hzc19GaWx0ZXJfRnJvbS5wbmdccGFyDQpcdGFi
IGh0dHA6Ly93d3cueGRpc2Nsb3NlLmNvbS9Yc3NfRmlsdGVyX1RvLnBuZ1xw
YXINClxwYXINClxwYXINCiAgIGQpIFlhaG9vIEFkcyBmbGFzaCBmaWxlIFhT
Uy5ccGFyDQpcdGFiIFRoZSBmbGF3cyBhcmUgZHVlIHRvIGltcHJvcGVyIHNh
bml0aXphdGlvbiBvZiBpbnB1dHMgcGFzc2VkIHRvXHBhcg0KICAgICAgICBm
bGFzaCBBZHMgZmlsZXNccGFyDQpccGFyDQpcdGFiIEV4cGxvaXQ6XHBhcg0K
XHRhYiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxwYXINClx0YWIgaHR0cDovL3Vz
LmExLnlpbWcuY29tL3VzLnlpbWcuY29tL2EveWEveWFob29fYW5zd2Vycy9c
cGFyDQpcdGFiIDIwMDYwMzMwXzY4MDA2X2Fza2VyMV9zb3VuZC5zd2Y/Y2xp
Y2tUQUc9amF2YXNjcmlwdFxwYXINClx0YWIgOmFsZXJ0KCdYU1MlMjBQb3Nz
aWFibGUlMjBpbiUyMFlhaG9vJTIwQWRzJTIwXFxuXHBhcg0KXHRhYiAlMjBC
eSUyMFJhamVzaCcpXHBhcg0KXHBhcg0KXHRhYiBodHRwOi8vdXMuYTEueWlt
Zy5jb20vdXMueWltZy5jb20vYS95YS95YWhvb19hbnN3ZXJzL1xwYXINClx0
YWIgMjAwNjAzMzBfNjgwMDZfMV80MjV4NjAwX21vbnN0ZXJfbW9ycGhfYXNr
ZXJfMV9jaGVjay5zd2Y/XHBhcg0KXHRhYiBjbGlja1RBRz1qYXZhc2NyaXB0
OmFsZXJ0KCdYU1MlMjBQb3NzaWFibGUlMjBpbiUyMFxwYXINClx0YWIgWWFo
b28lMjBBZHMlMjBcXG4lMjBCeSUyMFJhamVzaCcpXHBhcg0KXHBhcg0KXHRh
YiBodHRwOi8vdXMuYTEueWltZy5jb20vdXMueWltZy5jb20vaS9jY3MvbnVw
L2EvXHBhcg0KXHRhYiAwNDI0MDZfNjg5NDZfdjFfNzI4eDkwX3N1cGVyX251
cF9mdW4uc3dmP2NsaWNrVEFHPVxwYXINClx0YWIgamF2YXNjcmlwdDphbGVy
dCgnWFNTJTIwUG9zc2lhYmxlJTIwaW4lMjBZYWhvbyUyMEFkc1xwYXINClx0
YWIgJTIwXFxuJTIwQnklMjBSYWplc2gnKVxwYXINClxwYXINClx0YWIgaHR0
cDovL3VzLmExLnlpbWcuY29tL3VzLnlpbWcuY29tL2kvY2NzL251cC9hL1xw
YXINClx0YWIgMDQyNDA2XzY4OTQ2X3YxXzQyNXg2MDBfbW9uX251cF9tcGxh
Y2Uuc3dmP2NsaWNrVEFHPVxwYXINClx0YWIgamF2YXNjcmlwdDphbGVydCgn
WFNTJTIwUG9zc2lhYmxlJTIwaW4lMjBZYWhvbyUyMEFkc1xwYXINClx0YWIg
JTIwXFxuJTIwQnklMjBSYWplc2gnKVxwYXINClxwYXINClx0YWIgaHR0cDov
L2FkLmllLmRvdWJsZWNsaWNrLm5ldC84MTI2NjYvc3BlY3NhdmVyc18yXHBh
cg0KXHRhYiBmb3IxZXVyb18zMDB4MjUwLnN3Zj9jbGlja1RBRz1qYXZhc2Ny
aXB0OlxwYXINClx0YWIgYWxlcnQoJ1hTUyUyMFBvc3NpYWJsZSUyMGluJTIw
WWFob28lMjBBZHMlMjBcXG4lMjBccGFyDQpcdGFiIEJ5JTIwUmFqZXNoJylc
cGFyDQpccGFyDQpcdGFiIGh0dHA6Ly91cy5hMS55aW1nLmNvbS91cy55aW1n
LmNvbS9pL2Njcy9udXAvYS9ccGFyDQpcdGFiIDA0MjQwNl82ODk0Nl92MV83
Mjh4OTBfc3VwZXJfbnVwX3NpdC5zd2Y/Y2xpY2tUQUc9XHBhcg0KXHRhYiBq
YXZhc2NyaXB0OmFsZXJ0KCdYU1MlMjBQb3NzaWFibGUlMjBpbiUyMFlhaG9v
JTIwQWRzXHBhcg0KXHRhYiAlMjBcXG4lMjBCeSUyMFJhamVzaCcpXHBhcg0K
XHBhcg0KXHRhYiBodHRwOi8vdXMuYTIueWltZy5jb20vdXMueWltZy5jb20v
YS95YS95YWhvb19tZXNzZW5nZXIvXHBhcg0KXHRhYiAyMDA1MTAyOF82MTc2
MF8yXzQyNXg2MDBfbW9uX3NjYXJlaGltLnN3Zj9jbGlja1RBRz1ccGFyDQpc
dGFiIGphdmFzY3JpcHQ6YWxlcnQoJ1hTUyUyMFBvc3NpYWJsZSUyMGluJTIw
WWFob28lMjBBZHNccGFyDQpcdGFiICUyMFxcbiUyMEJ5JTIwUmFqZXNoJylc
cGFyDQpccGFyDQpcdGFiIGh0dHA6Ly91cy5hMi55aW1nLmNvbS91cy55aW1n
LmNvbS9hL3lhL3lhaG9vX21haWwvXHBhcg0KXHRhYiAyMDA2MDUxMl82NTQ1
OV8xXzM2MHgxMDBfbXdhMV9tYWlsX2FjY29sYWRlcy5zd2Y/XHBhcg0KXHRh
YiBjbGlja1RBRz1qYXZhc2NyaXB0OmFsZXJ0KCdYU1MlMjBQb3NzaWFibGUl
MjBpbiUyMFxwYXINClx0YWIgWWFob28lMjBBZHMlMjBcXG4lMjBCeSUyMFJh
amVzaCcpXHBhcg0KXHBhcg0KXHRhYiBhbmQgbW9yZVxwYXINClx0YWIgLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS1ccGFyDQpccGFyDQpcdGFiIFNjcmVlbnNob3Q6
XHBhcg0KXHRhYiBodHRwOi8vd3d3LnhkaXNjbG9zZS5jb20vWFNTX0ZsYXNo
X0Fkcy5wbmdccGFyDQpccGFyDQpccGFyDQogICBlKSBZYWhvbyBNYWlsIEJl
dGEgSFRUUCBIZWFkZXIgWFNTXHBhcg0KXHRhYiBUaGUgZmxhd3MgYXJlIGR1
ZSB0byBpbXByb3BlciBzYW5pdGl6YXRpb24gb2YgaW5wdXRzIHBhc3NlZCB0
b1xwYXINClx0YWIgYWxsIEhUVFAgaGVhZGVyIGxpa2UgQWNjZXB0LCBBY2Nl
cHQtQ2hhcnNldCwgQWNjZXB0LUxhbmd1YWdlLFxwYXINClx0YWIgQ2FjaGUt
Q29udHJvbCwgQ29ubmVjdGlvbiwgQ29udGVudC1MZW5ndGgsIENvbnRlbnQt
VHlwZSxccGFyDQpcdGFiIENvb2tpZSwgS2VlcC1BbGl2ZSwgUHJhZ21hLCBT
T0FQQWN0aW9uIGFuZCBVc2VyLUFnZW50IGluXHBhcg0KXHRhYiBZYWhvbyBN
YWlsIEJldGEuXHBhcg0KXHBhcg0KXHRhYiBQT0MgOlxwYXINClx0YWIgPT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT1ccGFyDQpcdGFiIEdFVCA6IFxwYXINClx0YWIg
aHR0cDovL3VrLmY1NTUubWFpbC55YWhvby5jb20veW13cz9tPUxpc3RGb2xk
ZXJzJndzc2lkPVxwYXINClx0YWIgQ0t5TzcvemNVVTJccGFyDQpccGFyDQpc
dGFiIEhvc3Q6IHVrLmY1NTUubWFpbC55YWhvby5jb21ccGFyDQpcdGFiIFVz
ZXItQWdlbnQ6IDxzY3JpcHQ+YWxlcnQoJ1VzZXItQWdlbnQ6Jyk8L3Njcmlw
dD5ccGFyDQpcdGFiIEFjY2VwdDogdGV4dC94bWwsYXBwbGljYXRpb24veG1s
LGFwcGxpY2F0aW9uL3hodG1sK3htbCx0ZXh0L1xwYXINClx0YWIgaHRtbDtx
PTAuOSx0ZXh0L3BsYWluO3E9MC44LGltYWdlL3BuZywqLyo7cT0wLjU7PHNj
cmlwdD5ccGFyDQpcdGFiIGFsZXJ0KCdBY2NlcHQ6Jyk8L3NjcmlwdD5ccGFy
DQpcdGFiIEFjY2VwdC1MYW5ndWFnZTogZW4tdXMsZW47cT0wLjU7PHNjcmlw
dD5hbGVydCgnQWNjZXB0LVxwYXINClx0YWIgTGFuZ3VhZ2U6Jyk8L3Njcmlw
dD5ccGFyDQpcdGFiIEFjY2VwdC1FbmNvZGluZzogZ3ppcCxkZWZsYXRlOzxz
Y3JpcHQ+YWxlcnQoJ0FjY2VwdC1ccGFyDQpcdGFiIEVuY29kaW5nOicpPC9z
Y3JpcHQ+XHBhcg0KXHRhYiBBY2NlcHQtQ2hhcnNldDogSVNPLTg4NTktMSx1
dGYtODtxPTAuNywqO3E9MC43OzxzY3JpcHQ+YWxlcnRccGFyDQpcdGFiICgn
QWNjZXB0LUNoYXJzZXQ6Jyk8L3NjcmlwdD5ccGFyDQpcdGFiIEtlZXAtQWxp
dmU6IDMwMDs8c2NyaXB0PmFsZXJ0KCdLZWVwLUFsaXZlOicpPC9zY3JpcHQ+
XHBhcg0KXHRhYiBDb25uZWN0aW9uOiBrZWVwLWFsaXZlOzxzY3JpcHQ+YWxl
cnQoJ0Nvbm5lY3Rpb246Jyk8L3NjcmlwdD5ccGFyDQpcdGFiIFNPQVBBY3Rp
b246IHVybjp5YWhvbzp5bXdzI0xpc3RGb2xkZXJzOzxzY3JpcHQ+YWxlcnRc
cGFyDQpcdGFiICgnU09BUEFjdGlvbjonKTwvc2NyaXB0PlxwYXINClx0YWIg
Q29udGVudC1MZW5ndGg6IDxzY3JpcHQ+YWxlcnQoJ0NvbnRlbnQtTGVuZ3Ro
OicpPC9zY3JpcHQ+XHBhcg0KXHRhYiBDb250ZW50LVR5cGU6IGFwcGxpY2F0
aW9uL3htbDs8c2NyaXB0PmFsZXJ0KCdDb250ZW50LVxwYXINClx0YWIgVHlw
ZTonKTwvc2NyaXB0PlxwYXINClx0YWIgQ29va2llOiBCPWRjbmw0ajEyOWM3
dHUmYj0zJnM9ajM7IFxwYXINClx0YWIgRj1hPWFOcXkxQ29zdlczQm1hR25v
NkJTTE9wWGtQMlBDZ2xDWjNfTERKdHRzOG9haXRuXHBhcg0KXHRhYiBrR2tn
T09qeHdQS1M2JmI9YklwcTtZPXY9MSZuPTBrdmd2Z3YzcWxmMTEmbD1pNDIu
ajRpai9vJlxwYXINClx0YWIgcD1tMmd2dmluZDEyMDAwNzAwJmpiPTE5fDI0
fCZpej0xMjM0NTZccGFyDQpcdGFiIHI9ZzQmbGc9dWsmaW50bD11ayZucD0x
O1BIPWZuPWVJaEtLb3E0ZFRHN0dqcjRGdEhxQ1RBLTtccGFyDQpcdGFiIFQ9
ej1XL2hsRUJXRjNsRUJyUmNMbkpHTFpLb01qSXlCalV5TmpVMk5FOU9Nekkt
JlxwYXINClx0YWIgYT1RQUUmc2s9REFBWjdvUXVZYWxTdVYmZD1jMndCVGxS
Vk1VRlVTVEZccGFyDQpcdGFiIE5WRWw0VFhwbk5VNUVWUzBCWVFGUlFVVUJk
R2x3QVZOUVpIaHZRZ0Y2ZWdGWEwyaHNSVUpuVjBFLTtccGFyDQpcdGFiIFU9
bXQ9N2xNNUZKMk1oWW8wV0oucHFEWmRwRklZMXBDUVpScTJRNmZ0ZHctLSZ1
eD1XL2hsRUJccGFyDQpcdGFiICZ1bj0wa3Zndmd2M3FsZjExO1lNLmRwcmVm
MT1zZWMudGVzdCUzQXNwcCUyNTdDMTs8c2NyaXB0PmFsZXJ0XHBhcg0KXHRh
YiAoJ0Nvb2tpZTonKTwvc2NyaXB0PlxwYXINClx0YWIgUHJhZ21hOiBuby1j
YWNoZTs8c2NyaXB0PmFsZXJ0KCdQcmFnbWE6Jyk8L3NjcmlwdD5ccGFyDQpc
dGFiIENhY2hlLUNvbnRyb2w6IG5vLWNhY2hlOzxzY3JpcHQ+YWxlcnQoJ0Nh
Y2hlLUNvbnRyb2w6JylccGFyDQpcdGFiIDwvc2NyaXB0PiJccGFyDQpcdGFi
ID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09XHBhcg0KXHBhcg0KXHRhYiBTY3JlZW5z
aG90OlxwYXINClx0YWIgaHR0cDovL3d3dy54ZGlzY2xvc2UuY29tL1hTU19N
YWlsQmV0YV9BY2NlcHQucG5nXHBhcg0KXHRhYiBodHRwOi8vd3d3LnhkaXNj
bG9zZS5jb20vWFNTX01haWxCZXRhX0FjY2VwdC1DaGFyc2V0LnBuZ1xwYXIN
Clx0YWIgaHR0cDovL3d3dy54ZGlzY2xvc2UuY29tL1hTU19NYWlsQmV0YV9B
Y2NlcHQtTGFuZ3VhZ2UucG5nXHBhcg0KXHRhYiBoaHR0cDovL3d3dy54ZGlz
Y2xvc2UuY29tL1hTU19NYWlsQmV0YV9DYWNoZS1Db250cm9sLnBuZ1xwYXIN
Clx0YWIgaHR0cDovL3d3dy54ZGlzY2xvc2UuY29tL1hTU19NYWlsQmV0YV9D
b25uZWN0aW9uLnBuZ1xwYXINClx0YWIgaHR0cDovL3d3dy54ZGlzY2xvc2Uu
Y29tL1hTU19NYWlsQmV0YV9Db250ZW50LUxlbmd0aC5wbmdccGFyDQpcdGFi
IGh0dHA6Ly93d3cueGRpc2Nsb3NlLmNvbS9YU1NfTWFpbEJldGFfQ29udGVu
dC1UeXBlLnBuZ1xwYXINClx0YWIgaHR0cDovL3d3dy54ZGlzY2xvc2UuY29t
L1hTU19NYWlsQmV0YV9Db29raWUucG5nXHBhcg0KXHRhYiBodHRwOi8vd3d3
LnhkaXNjbG9zZS5jb20vWFNTX01haWxCZXRhX0tlZXAtQWxpdmUucG5nXHBh
cg0KXHRhYiBodHRwOi8vd3d3LnhkaXNjbG9zZS5jb20vWFNTX01haWxCZXRh
X1ByYWdtYS5wbmdccGFyDQpcdGFiIGh0dHA6Ly93d3cueGRpc2Nsb3NlLmNv
bS9YU1NfTWFpbEJldGFfU29hcEFjdGlvbi5wbmdccGFyDQpcdGFiIGh0dHA6
Ly93d3cueGRpc2Nsb3NlLmNvbS9YU1NfTWFpbEJldGFfVXNlci1BZ2VudC5w
bmdccGFyDQpccGFyDQpccGFyDQpcdGFiIEltcGFjdDpccGFyDQpcdGFiIFN1
Y2Nlc3NmdWwgZXhwbG9pdGF0aW9uIGFsbG93cyBleGVjdXRpb24gb2YgYXJi
aXRyYXJ5IHNjcmlwdFxwYXINCiAgICAgICAgY29kZSBpbiBhIHVzZXJzIGJy
b3dzZXIgc2Vzc2lvbiBpbiBjb250ZXh0IG9mIGFuIGFmZmVjdGVkIHNpdGVc
cGFyDQogICAgICAgIHdoaWNoIG1heSBhbGxvdyB0byBzdGVhbCBjb29raWUg
YmFzZWQgYXV0aGVudGljYXRpb25ccGFyDQogICAgICAgIGNyZWRlbnRpYWxz
LlxwYXINCiAgXHBhcg0KMy4gVVJMIHJlZGlyZWN0aW9uLlxwYXINCiAgIFRo
aXMgaXMgZHVlIGZhaWx1cmUgb2YgZmlsdGVyaW5nIG9mIGluY29taW5nIHVu
dHJ1c3RlZCBkYXRhIGJlZm9yZVxwYXINCiAgIHRoZSBjb250ZW50IHJlYWNo
ZXMgdGhlaXIgdXNlcnMgLlRoaXMgY2FuIGJlIGV4cGxvaXRlZCBmb3IgcGhp
c2hpbmdccGFyDQogICBhdHRhY2suIFRoZSB2dWxuZXJhYmxlIHBhcmFtZXRl
cnMgYXJlIHlhaG9vIHNlYXJjaCB3ZWIsIGltYWdlLFxwYXINCiAgIHZpZGVv
LCBwcmVmZXJlbmNlcywgY2FjaGUsIHlhaG9vIGFuc3dlcnMgYW5kIG1vcmUg
dXJscyBjb250YWluaW5nICBccGFyDQogICAvKmh0dHA6Ly95YWhvby5jb20g
b3IgLyoqaHR0cDovL3lhaG9vLmNvbVxwYXINClxwYXINCiAgIEV4cGxvaXQ6
XHBhcg0KICBccGFyDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1c
cGFyDQogICBodHRwOi8vcmRzLnlhaG9vLmNvbS9feWx0PUFoMGdldXN5YU0y
eEV6cU1BalM5WE55b0EvU0lHPTExZG81cWRxNi9ccGFyDQogICBFWFA9MTE0
ODAyODE4Ni8qKmh0dHAlM2EvL3d3dy54ZGlzY2xvc2UuY29tXHBhcg0KXHBh
cg0KICAgaHR0cDovL3NlYXJjaC55YWhvby5jb20vcHJlZmVyZW5jZXMvcHJl
ZmVyZW5jZXM/cHJlZl9kb25lPVxwYXINCiAgIGh0dHAlM2EvL3d3dy54ZGlz
Y2xvc2UuY29tXHBhcg0KICBccGFyDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS1ccGFyDQpccGFyDQogICBTY3JlZW5zaG90OlxwYXINCiAgIGh0
dHA6Ly93d3cueGRpc2Nsb3NlLmNvbS9VUkxfUmVkaXJlY3Rpb25fV2ViU2Vh
cmNoLnBuZ1xwYXINCiAgIGh0dHA6Ly93d3cueGRpc2Nsb3NlLmNvbS9VUkxf
UmVkaXJlY3Rpb25fSW1hZ2VzLnBuZ1xwYXINCiAgIGh0dHA6Ly93d3cueGRp
c2Nsb3NlLmNvbS9VUkxfUmVkaXJlY3Rpb25fVmlkZW8ucG5nXHBhcg0KXHBh
cg0KNCkgSW50ZXJlc3RpbmcgZmFjdHMgYWJvdXQgWWFob28gXHBhcg0KICAg
WWFob28gTWFpbCBJbmJveCBzaG93cyB3cm9uZyB1bnJlYWQgbWVzc2FnZXMg
Y291bnQgaWYgaXQgaXMgYWJvdmVccGFyDQogICA2NTUzNSB1bnJlYWQgbWVz
c2FnZXMuXHBhcg0KIFxwYXINCiAgIFNjcmVlbnNob3Q6XHBhcg0KICAgaHR0
cDovL3d3dy54ZGlzY2xvc2UuY29tL1lhaG9vX0luYm94LnBuZ1xwYXINCiAg
XHBhcg0KT3JpZ2luYWwgQWR2aXNvcnk6XHBhcg0KaHR0cDovL3d3dy54ZGlz
Y2xvc2UuY29tL1hEMTAwMDAxLnR4dFxwYXINClxwYXINCkNyZWRpdHM6XHBh
cg0KUmFqZXNoIFNldGh1bWFkaGF2YW4gaGFzIGJlZW4gY3JlZGl0ZWQgd2l0
aCB0aGUgZGlzY292ZXJ5IG9mIHRoaXNccGFyDQp2dWxuZXJhYmlsaXR5XHBh
cg0KXHBhcg0KXHBhcg0KRGlzY2xhaW1lcjpccGFyDQpUaGlzIGVudGlyZSBk
b2N1bWVudCBpcyBzdHJpY3RseSBmb3IgZWR1Y2F0aW9uYWwsIHRlc3Rpbmcg
YW5kXHBhcg0KZGVtb25zdHJhdGluZyBwdXJwb3NlIG9ubHkuIE1vZGlmaWNh
dGlvbiB1c2UgYW5kL29yIHB1Ymxpc2hpbmcgdGhpc1xwYXINCmluZm9ybWF0
aW9uIGlzIGVudGlyZWx5IG9uIHlvdXIgb3duIHJpc2suIFRoZSBleHBsb2l0
IGNvZGUgaXMgdG8gYmVccGFyDQp1c2VkIG9uIHlvdXIgb3duIGVtYWlsIGFj
Y291bnQuIEkgYW0gbm90IGxpYWJsZSBmb3IgYW55IGRpcmVjdCBvciBccGFy
DQppbmRpcmVjdCBkYW1hZ2VzIGNhdXNlZCBhcyBhIHJlc3VsdCBvZiB1c2lu
ZyB0aGUgaW5mb3JtYXRpb24gb3JccGFyDQpkZW1vbnN0cmF0aW9ucyBwcm92
aWRlZCBpbiBhbnkgcGFydCBvZiB0aGlzIGFkdmlzb3J5LlxwYXINCn0NCgA=



--0-775780869-1151041985=:66173
Content-Type: text/plain; charset=us-ascii

----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
--0-775780869-1151041985=:66173--