Richar Leggett wrote on his blog that someone seems to have (re)discovered a new AJAX applications vulnerability and published a paper about that.
However, this type of vulnerability is already known:
when you do a request with Javascript you can only do that to the same domain of your script, but this doesn’t apply to
imgandscripttags
So if you browse a malicious site, this can do a request to any site trough your browser (with your cookies and credentials).
In Flash this isn’t possible thanks to the crossdomain.xml.
However ever this can lead to vulnerabilities if misconfigured or because of the new loadPolicyFile Flash function.
