alert no script

[g113]

good evening,

i'm french please excuse my english, but i have a problem with my web page, i have this alert and i don't now what doing !



thanks

[therube]

Check Error Console & see if it provides further information on the (potential) XSS & post the information here.

Link: Netvibes

[g113]

I suppose you mind that, it's the message in my console

[NoScript XSS] Nettoyé requête suspicieuse. URL originale [http://1292528297.nvmodules.netvibes.co ... C%2Fdiv%3E] demandée depuis [http://www.netvibes.com/#General]. URL nettoyée : [http://1292528297.nvmodules.netvibes.co ... 5196866220].

[g113]

up !

[Giorgio Maone]

NoScript is correct.
That page is actually vulnerable to XSS: try to open this url on a browser without NoScript.
IE8 will detect the XSS. Other browsers (including Firefox without NoScript) will show a XSS popup I'm injecting on the target page.
I strongly advidse to disable the Good Planet widget.

[g113]

thanks, but i can't disable this widget

[Giorgio Maone]

thanks, but i can't disable this widget

Then the less risky thing you can do then is granting the netvibes.com main page a free pass for sending XSS like request, by adding the following line in NoScript Options|Advanced|XSS|Exceptions:

Code: Select all

^@http://www.netvibes.com/

[g113]

thank you very much

it works