It was possible to create custom bookmarks by making the user open a
crafted URL. This created a bookmark in the users default bookmark list
clicks on the just created link.
For example the user session cookies can be read and reported to the
attackers, who could then hijack the users sessions with the application.
This issue has been fixed by limiting absolute URLs in bookmarks to the
URL schemes https and http.
To the list of all Werks