jetlib.sec » Tags » apache-myfaces

Feeds

133337 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

17 items tagged "apache myfaces"

Related tags: myfaces [+], apache [+], information disclosure vulnerability [+], vulnerability [+], security [+], information disclosure [+], information [+], disclosure [+], web [+], txt [+], twsl [+], thai duong [+], sun microsystems [+], spiderlabs [+], secunia [+], ruby [+], rizzo tags [+], mojarra [+], latin america [+], joe [+], development frameworks [+], cve [+], crypto [+], attack [+], advisory [+], security restrictions [+], security advisory [+], retired [+], presentation [+], gui objects [+], expression evaluation [+], expression [+], david byrne rohini sulatycki [+], asp [+], application variables [+], application [+]

• February 11, 2012
• 23:50

  Secunia Security Advisory 47973

   » ‎ Packet Storm Security Advisories
  Secunia Security Advisory - A vulnerability has been reported in Apache MyFaces, which can be exploited by malicious people to disclose certain sensitive information.

  Tags:  advisory secunia security apache-myfaces security-advisory  

• February 10, 2012
• 14:20

  Apache MyFaces Information Disclosure

   » ‎ Packet Storm Security Exploits
  Apache MyFaces Core versions 2.0.1 to 2.0.11 and 2.1.0 to 2.1.5 suffer from a remote file disclosure vulnerability.

  Tags:  disclosure myfaces apache apache-myfaces information-disclosure vulnerability  

• 14:20

  Apache MyFaces Information Disclosure

   » ‎ Packet Storm Security Recent Files
  Apache MyFaces Core versions 2.0.1 to 2.0.11 and 2.1.0 to 2.1.5 suffer from a remote file disclosure vulnerability.

  Tags:  disclosure myfaces apache apache-myfaces information-disclosure vulnerability  

• 14:20

  Apache MyFaces Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  Apache MyFaces Core versions 2.0.1 to 2.0.11 and 2.1.0 to 2.1.5 suffer from a remote file disclosure vulnerability.

  Tags:  disclosure myfaces apache apache-myfaces information-disclosure vulnerability  

• February 09, 2012
• 11:03

  Bugtraq: [SECURITY] CVE-2011-4367 Apache MyFaces information disclosure vulnerability

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-4367 Apache MyFaces information disclosure vulnerability

  Tags:  security myfaces apache information-disclosure-vulnerability apache-myfaces  

• December 06, 2011
• 0:00

  Vuln: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability

  Tags:  information-disclosure-vulnerability apache-myfaces cve  

• 0:00

  Vuln: RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability

  Tags:  retired myfaces apache information-disclosure-vulnerability apache-myfaces cve  

• 0:00

  Vuln: Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability

  Tags:  expression myfaces apache apache-myfaces expression-evaluation vulnerability  

• December 05, 2011
• 5:11

  Apache MyFaces 2.0 / 2.1 Information Disclosure

   » ‎ Packet Storm Security Exploits
  Apache MyFaces Core versions 2.0.1 through 2.0.10 and versions 2.1.0 through 2.1.4 suffer from an information disclosure vulnerability.

  Tags:  information myfaces apache information-disclosure-vulnerability apache-myfaces  

• 5:11

  Apache MyFaces 2.0 / 2.1 Information Disclosure

   » ‎ Packet Storm Security Recent Files
  Apache MyFaces Core versions 2.0.1 through 2.0.10 and versions 2.1.0 through 2.1.4 suffer from an information disclosure vulnerability.

  Tags:  information myfaces apache information-disclosure-vulnerability apache-myfaces  

• 5:11

  Apache MyFaces 2.0 / 2.1 Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  Apache MyFaces Core versions 2.0.1 through 2.0.10 and versions 2.1.0 through 2.1.4 suffer from an information disclosure vulnerability.

  Tags:  information myfaces apache information-disclosure-vulnerability apache-myfaces  

• November 28, 2011
• 18:46

  Secunia Security Advisory 47048

   » ‎ Packet Storm Security Advisories
  Secunia Security Advisory - A vulnerability has been reported in Apache MyFaces, which can be exploited by malicious people to bypass certain security restrictions.

  Tags:  advisory secunia security apache-myfaces security-restrictions  

• June 17, 2010
• 21:05

  [Slides] Practical Crypto Attacks Against Web Applications

   » ‎ SecDocs
  Authors: Thai Duong Juliano Rizzo
  Tags: web application cryptography cracking
  Event: Black Hat EU 2010
  Abstract: In 2009, we released a paper on MD5 extension attack ([1]), and described how attackers can use the attack to exploit popular web sites such as Flickr, Vimeo, Scribd, etc. The attack has been well-received by the community, and made the Top Ten Web Hacking Techniques of 2009 ([2]). In the conclusion of that paper, we stated that we have bexen carrying out a research in which we test-run a number of identified practical crypto attacks on random widely-used software systems. To our surprise, most, if not all, can be attacked by one or more of well-known crypto bugs. In this talk, we present the latest result of that research, where we choose another powerful crypto attack, and turn it into a new set of practical web hacking techniques. We show that widely used web development frameworks and web sites are using encryption wrongly that allow attackers to read and modify data that should be protected. It has been known for years in cryptography community that encryption is not authentication. If encrypted messages are not authenticated, data integrity cannot be guaranteed which makes systems vulnerable to practical and dangerous chosen-ciphertext attacks. Finally, we list several popular web development frameworks and web sites that are vulnerable to Padding Oracle attacks, including, but not limited to, eBay Latin America, Apache MyFaces, SUN Mojarra, Ruby On Rails, etc. These are all 0-day vulnerabilities. We show that even OWASP folks can't get it right, how can an average Joe survive this new class of vulnerabilities? We strongly believe that this is just the tip of the iceberg, and the techniques we describe in this research would uncover many more vulnerabilities for years to come.

  Tags:  attack crypto web joe rizzo-tags ruby latin-america thai-duong apache-myfaces development-frameworks  

• 2:13

  [Paper] Practical Crypto Attacks Against Web Applications

   » ‎ SecDocs
  Authors: Thai Duong Juliano Rizzo
  Tags: web application cryptography cracking
  Event: Black Hat EU 2010
  Abstract: In 2009, we released a paper on MD5 extension attack ([1]), and described how attackers can use the attack to exploit popular web sites such as Flickr, Vimeo, Scribd, etc. The attack has been well-received by the community, and made the Top Ten Web Hacking Techniques of 2009 ([2]). In the conclusion of that paper, we stated that we have bexen carrying out a research in which we test-run a number of identified practical crypto attacks on random widely-used software systems. To our surprise, most, if not all, can be attacked by one or more of well-known crypto bugs. In this talk, we present the latest result of that research, where we choose another powerful crypto attack, and turn it into a new set of practical web hacking techniques. We show that widely used web development frameworks and web sites are using encryption wrongly that allow attackers to read and modify data that should be protected. It has been known for years in cryptography community that encryption is not authentication. If encrypted messages are not authenticated, data integrity cannot be guaranteed which makes systems vulnerable to practical and dangerous chosen-ciphertext attacks. Finally, we list several popular web development frameworks and web sites that are vulnerable to Padding Oracle attacks, including, but not limited to, eBay Latin America, Apache MyFaces, SUN Mojarra, Ruby On Rails, etc. These are all 0-day vulnerabilities. We show that even OWASP folks can't get it right, how can an average Joe survive this new class of vulnerabilities? We strongly believe that this is just the tip of the iceberg, and the techniques we describe in this research would uncover many more vulnerabilities for years to come.

  Tags:  attack crypto web joe rizzo-tags ruby latin-america thai-duong apache-myfaces development-frameworks  

• May 14, 2010
• 9:31

  [Slides] Beware of Serialized GUI Objects Bearing Data

   » ‎ SecDocs
  Authors: David Byrne Rohini Sulatycki
  Tags: web application ASP.NET
  Event: Black Hat DC 2010
  Abstract: This presentation will highlight 0-days in Apache MyFaces and Sun Mojarra that allow an attacker to access all server-side session data, as well as some globally-scoped application variables. This presentation will provide a live demonstration of the flaws. The tool used to exploit the vulnerability will also be released. A similar vulnerability is present in Microsoft's ASP.Net view state. This may not technically be an 0-day, but it is a poorly known flaw that has been present since the beginning days of .Net. A live demonstration of this will also be performed.

  Tags:  asp presentation application david-byrne-rohini-sulatycki apache-myfaces application-variables gui-objects  

• February 09, 2010
• 19:00

  TWSL2010-001.txt

   » ‎ Packet Storm Security Recent Files
  SpiderLabs has documented view state tampering vulnerabilities in three products from separate vendors. Microsoft ASP.Net version 3.5, Apache MyFaces versions 1.2.8 and 1.2.7, and Sun Microsystems Mojarra versions 1.2_14 and 2.0.2 are all vulnerable.

  Tags:  txt spiderlabs twsl apache-myfaces sun-microsystems mojarra  

• 19:00

  TWSL2010-001.txt

   » ‎ Packet Storm Security Exploits
  SpiderLabs has documented view state tampering vulnerabilities in three products from separate vendors. Microsoft ASP.Net version 3.5, Apache MyFaces versions 1.2.8 and 1.2.7, and Sun Microsystems Mojarra versions 1.2_14 and 2.0.2 are all vulnerable.

  Tags:  txt spiderlabs twsl apache-myfaces sun-microsystems mojarra