My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
I have a URL to a flash file. Sample :- http://abc.mydomain.com/Findme.swf Now, there is a parameter called xmlpath as :- http://abc.mydomain.com/Findme.swf?xmlPath=something. Is it not that ...