Flash-based cross-scripting LJ security hole

[solarbird]

As described in this post in News, there's a Flash-based cross-site scripting bug that edits the most recent post of any logged in user who views content containing the script. This journal's previous entry was affected - code embedding infected video was added to that post after I viewed an apparently-infected post on my friendslist. As a result, LJ staff have partially disabled embedding while they work on a better solution. So be aware of this, and check your most recent posts as described in this post in News. Youtube embeds aren't affected, and have already been re-whitelisted.

Comments

[blues-kun.livejournal.com]

So that's what that goofy box shit was about.

Good thing I have embedded media blocked by default and run Flashblock on top of that, lol~