CVE-2007-2383 – Debian Linux Security Advisory 1952-1

https://notcve.org/view.php?id=CVE-2007-2383

30 Apr 2007 — The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking." El framework Prototype (prototypejs) versiones anteriores a 1.5.1 RC3, intercambia datos usando JavaScript Object Notation (JSON) sin un es... • http://dev.rubyonrails.org/ticket/7910 •