Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following code in an SWF file that a vulnerability scanner marks as XSS:

// Action0
        var __callResult_6 = getURL(_root.thankYou, "_self");
        var __callResult_7 = stop();


How can it be exploited and how can it be patched if exploitable?

share|improve this question

migrated from Dec 15 '11 at 11:22

This question came from our site for system and network administrators.

You'll find a detailed description of the issue HERE

share|improve this answer
Please provide some actual content that addresses the question in your answer - not just a link. – Iszi Dec 15 '11 at 14:51
I want to speak up in defense of SinistraD. His link is exactly spot-on. It completely answers the question. I wish people would stop giving SinistraD a hard time. I don't see any reason why it helps anyone in the world to try to write the explanation found at that link here, all over again. Heaven forbid I should have to lift my index finger and click on a link. (And if the link disappears, just use It's not rocket science.) – D.W. Dec 19 '11 at 5:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.