CGISecurity Logo

Topics

Tags

  • Hacker cracks Google Blogger security

    Posted by Robert A on

    in
    ,
    | |

    "Google was left red-faced on Saturday when a bug in its Blogger software allowed an unauthorised user to post a comment on the official Google blog. The post, which stayed up for around an hour before being pulled, claimed that Google had abandoned its click-to-call and Adwords partnership with eBay because of "monopolistic" concerns." Article…

  • Firefox Zero-Day Code Execution Hoax?

    Posted by Robert A on

    in
    ,
    | |

    "A public claim by hackers that Mozilla's Firefox browser is vulnerable to multiple code execution vulnerabilities may be an overblown hoax. On the heels of a ToorCon presentation where two security researchers—Mischa Spiegelmock and Andrew Wbeelsoi—warned that Firefox's implementation of JavaScript was badly flawed and could allow PC takeover attacks, Mozilla's engineers say the risk…

  • More RSS Security Issues Discovered

    Posted by Robert A on

    in
    | |

    GNUCitizen has discovered an RSS reader vulnerability in Sage (a firefox plugin). "I turned off HTML tags and continued on as normal. However, something odd happened. When rendering my whitepaper “Awakening the Sleeping Giant” an insert of JavaScript was executed in my browser. How bazaar I thought. The security enabled feature makes me vulnerable. Sage…

  • RSS Security Issues Discovered in ICQ

    Posted by Robert A on

    in
    | |

    "Security problems found in the ICQ Toolbar v1.3 may allow attackers to control and change configuration settings and to inject scripting code in RSS feed contents and execute it in the contetxt of the feed interface (IE's Local Zone)" I released a paper and gave a presentation at blackhat this year about these sorts of…

  • Ruby On Rails Mandatory Security Patch Issued

    Posted by Robert A on

    in
    | |

    "We're still hard at work on Rails 1.2, which features all the new dandy REST stuff and more, but a serious security concern has come to our attention that needed to be addressed sooner than the release of 1.2 would allow. So here's Rails 1.1.5! This is a MANDATORY upgrade for anyone not running on…

  • Not All Banks Requiring SSL

    Posted by Robert A on

    in
    , ,
    | |

    According to news entry on DSHIELD some banks aren't requiring SSL, and even worse aren't submitting credentials over ssl. The findings can be found below. Research Finding Link: https://www.securewebbank.com/loginssluse.html

  • PAPER: Preventing Http Session Fixation Attacks

    Posted by Robert A on

    in
    , , , ,
    | |

    Zinho Writes "I've published the final research about Http Session Fixation covering the most known attacks and how to prevent them. The paper is written from a web developer point of view and shows various techniques to be safe from fixation and hijacking." Paper Link: Preventing Http Session Fixation Attacks (Paper)

  • PHP 4.3.8 released to address security issues

    Posted by Robert A on

    in
    | |

    PHP 4.3.8 and 5.0.0RC3 were released today to address a few security problems. Users running older versions are urged to upgrade (bla bla bla). PHP Download Page PHP Changelog

  • IIS 4.0 Buffer overflow discovered and other microsoft patches

    Posted by Robert A on

    in
    | |

    Microsoft has released 7 different advisories today. One of the vulnerabilities disclosed was a remote overflow in IIS 4.0.

  • Microsoft Frontpage Overflow

    Posted by Robert A on

    in
    | |

    First off sorry for the lag on site updates. I'll be gone all next week and I've been busy. A chunked encoding overflow has been discovered in fp30reg.dll which can allow a remote attacker to execute commands. More importantly this took 11 months to get fixed. Rele vant information from the advisory. "Public disclosure on…

  • Oracle Application Server 9i and RDBMS Multiple SQL Injection Vulnerabilities

    Posted by Robert A on

    in
    | |

    "Oracle's RDBMS, a leading database server package, supports stored packages and procedures through the use of PL/SQL. These packages and procedures can be accessed through Oracle's Application Server's Portal module. Oracle Application Server is a web server designed for Oracle applications. Many of the PL/SQL packages and procedures are vulnerable to SQL Injection. Using these…

  • OpenSSL Multiple vulnerabilities

    Posted by Robert A on

    in
    | |

    Four security issues have been discovered in Openssl. Below are the relevant snippets from the advisory below. "1. Certain ASN.1 encodings that are rejected as invalid by the parser can trigger a bug in the deallocation of the corresponding data structure, corrupting the stack. This can be used as a denial of service attack. It…

  • Two new Blind SQL Injection papers released

    Posted by Robert A on

    in
    , , ,
    | |

    This week two new papers on blind sql injection have been released. The first paper was released by Webcohort goes into detail on how to detect blind sql injection, and how to carry out an attack. The paper released by Spidynamic's "SPI Labs" covers similar information, but also contains example 'fixes' for ASP.NET, and JSP…

  • Cumulative Patch for Internet Information Service

    Posted by Robert A on

    in
    | |

    SPI Labs and NSFocus have discovered multiple holes in IIS. Two denial of service conditions exist that can allow an attacker to cause IIS to stop responding. One Cross site scripting issue exists in the 302 redirection pages, and one buffer overflow that allows command execution as the webserver user. The buffer overflow requires the…

  • Apache Pre 2.0.46 Denial of Service

    Posted by Robert A on

    in
    | |

    Below is a snippet from the apache advisory. Apache 2.0.46 Major changes Security vulnerabilities closed since Apache 2.0.45 *) SECURITY [CAN-2003-0245]: Fixed a bug that could be triggered remotely through mod_dav and possibly other mechanisms, causing an Apache child process to crash. The crash was first reported by David Endler and was researched and fixed…

  • Sun One Application Server Multiple vulnerabilities

    Posted by Robert A on

    in
    | |

    SPI Labs Has identified four issues in the popular Sun One application server. They range from Source code theft, Log evasion, Cross site scripting, and plaintext administrative password storage. Sun One Multiple Issues

  • Macromedia Flash Activex Buffer overflow

    Posted by Robert A on

    in
    ,
    | |

    www.eeye.com has found a buffer overflow in Macromedia's flash.This hole was found by accident while surfing a websitewhen eeye noticed some strange errors. After further investigation they found that they could inject commandsinto the player stack. Anyone who uses flash is is urged to upgrade to version6 revision 29.

  • Apache Pre 1.3.24 on win32 allows command execution

    Posted by Robert A on

    in
    ,
    | |

    Ory Segal from sanctuminc.com has found ahole in apache versions prior to 1.3.24 which allowsan attacker to execute commands on win 32 versionsof apache. This is considered a serious threat and youshould upgrade immediately. On another note a minorhole in every version was fixed. I have included thatchange log snippet below.— Snippet from change log…

  • Opera Browser has several Javascript vulnerabilities

    Posted by Robert A on

    in
    , ,
    | |

    Georgi Guninski has found that the operabrowser is vulnerable to multiple Javascript holes.These holes could allow an attacker to gain furtherprivileges.Opera Browser problems

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.