«
Expand/Collapse
1059 items tagged "xss"
Related tags:
cross site scripting [+],
microsoft [+],
sql [+],
forgery [+],
code [+],
sql injection [+],
rich lundeen [+],
jesse ou [+],
injection [+],
indiana jones 4 [+],
indiana [+],
hpsbmu [+],
edge cases [+],
apache [+],
widget [+],
whitepaper [+],
web interface [+],
usa [+],
stored [+],
session fixation [+],
sap [+],
mutiple [+],
library [+],
internet [+],
dom [+],
chaos communication congress [+],
day [+],
htb [+],
vulnerability [+],
xml entity [+],
wordpress plugin [+],
wishlist [+],
wiki [+],
vanilla [+],
utm [+],
upload [+],
travis rhodes [+],
table overview [+],
table [+],
swdesk [+],
shell [+],
pr10 [+],
ocs inventory [+],
ocs [+],
movistar [+],
module versions [+],
module [+],
mandriva linux [+],
library versions [+],
inventory [+],
internet explorer [+],
firewall [+],
endian [+],
drupal [+],
database [+],
cross [+],
creation vulnerability [+],
chile [+],
arbor networks [+],
application [+],
apache 2 [+],
account creation [+],
bugtraq [+],
year and four months [+],
yaws [+],
writing secure code [+],
winn guestbook [+],
twiki [+],
tinywebgallery [+],
tinyguestbook [+],
time authors [+],
tiki wiki [+],
tiki [+],
tag [+],
street fight [+],
sourcebans [+],
slides [+],
sleeping giant [+],
site [+],
shah tags [+],
security appliance [+],
ryan c. barnett [+],
rule [+],
rich internet [+],
ria [+],
report management [+],
reflected [+],
raghav [+],
presistent [+],
php [+],
persistent [+],
peakflow [+],
patch [+],
owasp [+],
oracle [+],
notification [+],
ngs [+],
networks [+],
lms [+],
lazyest [+],
knowledgetree [+],
kicking [+],
javascript content [+],
hat europe [+],
groupware [+],
google [+],
ghosts [+],
future [+],
external resources [+],
explorer [+],
exploitation [+],
europe [+],
ensino [+],
dominant creature [+],
disclosure [+],
directory [+],
demonstration page [+],
deadly cocktail [+],
cve [+],
cart [+],
bypassing [+],
bugzilla [+],
browser game [+],
browser [+],
billy rios [+],
authors [+],
ariadne [+],
amp [+],
ajax [+],
account [+],
abu dhabi [+],
multiple [+],
security bulletin [+],
webapps [+],
security [+],
zikula [+],
xoops [+],
wp stats dashboard [+],
wikyblog [+],
wikiwig [+],
wicket [+],
webspell [+],
website manager [+],
websense [+],
webmin [+],
webid [+],
web security [+],
web poll [+],
web conferencing [+],
warns [+],
vitalogyweb [+],
viscacha [+],
virus scan [+],
virus [+],
viewer [+],
video [+],
vfront [+],
version 6 [+],
vbseo [+],
user [+],
uploadify [+],
uc web [+],
triton [+],
thomson [+],
syndeocms [+],
sphinix [+],
spacenuke [+],
socialgrid [+],
smartermail [+],
simpliscms [+],
simple chat [+],
simple [+],
servicedesk [+],
serendipity [+],
selectapix [+],
secure [+],
school [+],
sasha [+],
sap netweaver [+],
safer use [+],
s r [+],
router [+],
rev [+],
response management system [+],
reflective [+],
redmine [+],
rc5 [+],
rapidleech [+],
protocol handler [+],
privilege [+],
postcards [+],
post [+],
podcast [+],
plone [+],
phpgraphy [+],
phpcollab [+],
phpalbum [+],
php guestbook [+],
paper [+],
page [+],
oneorzero [+],
novel techniques [+],
next [+],
newscoop [+],
news [+],
netweaver [+],
netwaver [+],
net [+],
mobile web server [+],
mitel [+],
mingle [+],
mibew [+],
metasploit [+],
messenger [+],
mercury [+],
maui [+],
matthew [+],
management homepage [+],
manageengine [+],
login [+],
lknsupport [+],
lightneasy [+],
lifetype [+],
lfi [+],
kongreg [+],
joomla [+],
jakcms [+],
ja programacao [+],
iwantonebutton [+],
interface [+],
integration [+],
insight manager [+],
inline [+],
information disclosure [+],
information [+],
inclusion [+],
image gallery [+],
http header [+],
http [+],
hp system [+],
hp power [+],
hide your [+],
hesk [+],
guestbook v2 [+],
guestbook [+],
glfusion [+],
glassfish [+],
ggb [+],
gekko [+],
gbook [+],
framejammer [+],
fortimail [+],
fork [+],
flexcms [+],
flaw [+],
flatpress [+],
firstlastnames [+],
filter internet [+],
fcms [+],
fast [+],
fanupdate [+],
eshop [+],
escalation [+],
eleanor cms [+],
eleanor [+],
edition [+],
ebuddy [+],
dotproject [+],
dotclear [+],
dominant [+],
docuwiki [+],
docuform [+],
doc [+],
discovered [+],
directory traversal [+],
directory listing [+],
diafan [+],
default [+],
dashboard [+],
dalbum [+],
daily [+],
cve request [+],
cubecart [+],
csrf [+],
crystal reports [+],
creature [+],
core edition [+],
compactcms [+],
collabtive [+],
clic [+],
clansphere [+],
chyrp [+],
bmc [+],
blogx [+],
blind [+],
black hat [+],
bigace [+],
baby [+],
b xphone [+],
axous [+],
awc [+],
authentication [+],
atutor [+],
attack patterns [+],
asp [+],
artur janc [+],
archiva [+],
apprain [+],
application authors [+],
aims [+],
Topics [+],
bulletin [+],
vulnerabilities [+],
security vulnerabilities [+],
web [+],
hpsbma [+],
cms [+],
zyxel,
zoph,
zomplog,
zaki cms,
zaki,
youtube,
yektaweb,
yahoo,
xtcommerce,
xplico,
x cms,
www,
wscms,
worm,
wordpress,
wmscms,
wms,
wireless router,
wiccle,
whois,
whizzy,
websmart,
website,
webshop,
webnetwork,
webmatic,
webmanager,
webmail,
webit,
web worm,
web suite,
web server,
web help,
web builder,
web brand,
wcm,
washington university in st louis,
washington,
warszawa,
wampserver,
vulnerability audit,
vul,
vpn,
vodu,
vodpod video,
vodpod,
vodafone,
virtual keyboard,
virtual,
vindsl,
videowhisper,
videosearchscript,
videodb,
video gallery,
video chat,
version,
vecchi,
vbulletin,
variation,
vam,
utstats,
usr,
user agent,
url,
university,
understanding,
ultrabb,
uloki,
ubb threads,
ubb,
txt,
twitter,
tumblr,
truc,
trixbox,
translate,
trading,
trade,
trackwise,
toronja,
tornadostore,
topsite,
toolkit sdk,
toolkit,
token,
tikiwiki,
threadid,
thingie,
theeta,
tgz,
textpattern,
tenable network security,
tenable,
template,
teamaccess,
tcms,
tagcloud,
system,
swf,
sweetrice,
suzuki xss,
suzuki,
suspected,
surgemail,
sugarcrm,
subversion,
subrion,
subject field,
subdreamer,
stumbleupon,
studio,
stealing,
stats,
st.louis,
ssrt,
ssl vpn,
ssl,
srl,
squirrelmail,
sqli,
spitfire,
spip,
speed connection,
speed,
spectrum software,
spectrum,
sparta,
spam,
spaceacre,
solveable,
software index,
softbiz,
socialware,
social networking,
social,
snews,
sitename,
siteminder,
siteloom,
simpnews,
simpgb,
silverstripe,
siestta,
siebel crm,
siebel,
shoutbox,
shopzilla,
shopping cart,
shopping,
shop,
sharetronix,
sharepoint server 2007,
sharepoint,
shaadiclone,
sethi,
server v4,
server installations,
server,
security risk,
security linux,
security advisory,
security advisories,
securid,
secure desktop,
search module,
search,
sdk versions,
sdk,
scripts,
scripting,
script sql,
script php,
script,
scribe,
scratcher,
scheda,
sbd,
saved,
saurus cms,
saurus,
santafox,
s mp3,
ruubikcms,
runcms,
rumba,
rscomments,
rsa,
ronny cms,
ronny,
rokin,
rialto,
rfi,
revolution,
reservations,
repairshop,
rent,
remote,
release candidate,
referer header,
redirection,
rediff,
recommend,
read,
rce,
rc3,
razorcms,
rave,
radius,
radiant,
quot quot,
quot,
quality center,
quality,
punbb,
pulse,
ptc,
prtg,
proper location,
promotion,
profile customization,
portalapp,
portal script,
portal,
polypager,
polls,
poll script,
poll,
poc,
pmwiki,
pluxml,
plugin,
pligg,
platform version,
platform,
pixie,
piwik,
pishbini,
ping tool,
pimcore,
phreebooks,
phpwind,
phpplanner,
phpmysite,
phpmyfaq,
phpmyadmin,
phpinfo,
phpfaber,
phpeppershop,
phpbb,
phpauthentadmin,
php calendar,
phonebook,
pgautopro,
persistant,
persian,
penetration testers,
pecio,
pdf,
paysitereviewcms,
paypal,
parameter,
paloalto,
palo alto,
paessler,
ossim,
oscommerce,
os 6,
orange uk,
orange co,
orange,
oracle web server,
oracle siebel,
openjournalsystem,
openemr,
opencms,
openclassifieds,
onyx,
online,
onion,
onepound,
onecms,
onapsis,
ofbiz,
oamp,
npds,
noscript,
norton,
ninkobb,
ning,
nikiara,
nigi,
nextgen,
network vulnerability,
network,
netwin,
netsolution,
nct,
nationalcybersecurity,
myworks,
mystic,
mybb,
mullti,
mortgage,
mollify,
moha,
modx,
mobster,
mobile interface,
mobile chat,
mobile,
mkportal,
milehigh,
mihao,
microsoft sharepoint server,
microsoft sharepoint portal,
micro,
metric,
metinfo,
merchant v2,
merchant,
menu version,
members area,
members,
media,
mechbunny,
mds,
mblogger,
maxdev,
matthew flick tags,
matrimonial,
marketplace,
marinet,
mango,
management center,
management,
mambo,
malicious data,
malformed,
make,
mail,
mahyanet,
made,
macs,
lokomedia,
loja,
lizzard,
livestreet,
livehelp,
lisk,
linux versions,
lineacms,
limny,
lightsabre,
leonardo,
lenta,
lantern,
klonews,
kleophatra,
kitchen,
kft,
keyboard plugin,
kconsulting,
kasseler,
kandidat,
k search,
juniper secure,
juniper ive,
jugando,
jsupport,
joomproperty,
jobs,
job,
jira,
jevents,
jcomments,
jcart,
jaws,
javascript,
isecauditors,
iprov,
invoices,
internet explorer 8,
intelligent management,
instantlink,
insertion,
input validation,
infolink,
index,
incoming email,
impresscms,
imc,
image,
iboutique,
ibm websphere portal,
ibibo,
hybrid web,
html url,
html,
hp servers,
hot links,
hosting,
horoscop,
horde imp,
horde,
hijacking,
hijack,
hexjector,
helpdesk,
havij,
harvard university,
harvard,
hackvertor,
hacktics,
hacking,
habari,
grandora,
grafik,
gpeasy,
gmail,
getsimple,
gejosoft,
gareth heyes,
fusion,
fusetalk forums,
fusetalk,
full disclosure,
friendster,
free website creator,
free,
fraud management,
fraud,
forumcms,
forum version,
forum php,
forum,
footbal,
flock browser,
flock,
flick,
flashcard,
flash,
fjallfoss,
first entertainment,
filter,
filenice,
file,
festos,
feb,
fcgi bin,
fccgov,
faq,
family guestbook,
family,
factory,
facebook,
ezodiak,
exv,
extreme,
expression,
exposes,
exponent,
exploit,
evx,
evuln,
evasion,
euchia,
eswap,
error details,
ericsson,
eocms,
entrans,
enterprise manager,
enterprise,
engine,
encryption decryption,
encryption,
emihost,
email,
elxis,
elms,
elitecms,
elite,
elenco,
elastix,
eduardo vela,
edit,
eden,
ecomat,
ecocms,
eazycms,
easypublish,
easyphotostore,
easyjobportal,
easygb,
easycms,
easycarportal,
easybiller,
easy,
e107,
e php,
e business,
dynamixgate,
dvbbs,
duhok,
drupalmp,
dreamsoft,
dream factory,
dotdefender,
don ankney,
dom based xss,
dom based cross,
dom based,
dojo,
documents section,
docmint,
docebo,
doc base,
dmxready,
dlinkdi,
dlink di 604,
dlink,
discuz,
digital kitchen,
digital,
diferior,
diem,
dia,
detecting,
desktop,
design,
decryption,
dcp portal,
dbsite,
dbhcms,
daybiz,
david lindsay,
dating,
datalife,
dataface,
darknet,
damianov,
dada,
d link,
d greinar,
d cloud,
cyclecms,
cybsec,
customization,
customer portal,
customer,
customcms,
cumulus,
csice,
cruxpa,
cruxcms,
cross site,
croogo,
creations,
cpanel,
cookie,
content management system,
content folder,
content components,
content,
concrete,
compucms,
comptel,
component version,
component,
community forum,
commerce versions,
commerce,
comments,
com,
collabnet,
cold fusion application,
code execution,
cmsmadesimple,
cmsimple,
cmscout,
cisco secure,
cisco,
chklogin,
chipmunk,
chillycms,
chilly,
checker,
chcounter,
chat,
character transformations,
chaos,
chained,
cerberus,
centrepiece,
center,
ceica,
catphones,
catalogo,
captcha,
candid,
campsite,
calendar versions,
calendar,
calculator version,
calculator,
cactushop,
cacti,
bypass,
bxr,
business web,
business suite,
builder,
brand web,
brand developers,
box,
blogbird,
blog,
bitweaver,
bgs,
beta6,
beta1,
beta,
besso,
bcaccount,
bc component,
bbsmax,
bbcode,
bbblog,
bassanonet,
bard,
badoo,
b2b trading,
b2b marketplace,
b marketplace,
avarcade,
auto classifieds,
auto,
authenticated,
audio,
auctions,
atmail,
atacimo,
astrology,
asterisk,
astaro,
asimple,
arwscripts,
article,
artgk,
arisg,
ardguest,
arcademsx,
arcade,
arabic,
application framework,
apple xss,
apple itunes,
apple,
apphp,
api software,
apache axis2,
answer,
anonymous,
ankney,
angel lms,
ane,
and,
analyticator,
amortization calculator,
amortization,
amiro,
amethyst,
altconstructor,
alpha2,
alpha,
allinta,
alkakon,
alfa 1,
affiliate store,
affiliate script,
affiliate,
aef,
advisory,
advisories,
advanced,
administrative section,
add,
acuity,
activemq,
active media,
action parameter,
action,
acontent,
achecker,
access,
abzarak,
aardvark,
Tools,
Support,
Software,
Release,
NON,
General,
Forums,
FCC,
ExploitsVulnerabilities,
Community,
BackTrack,
4site
Skip to page:
1
2
3
...
5
-
-
21:29
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Travis Rhodes Tags:
web application XSS Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn’t even the hard part, it’s keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90’s RFCs and 2010’s HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let’s never talk about that again. Ever. Take Facebook, Office 365, Wordpress, Exchange, and Live. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we’ll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks. The best description is probably via the slides linked below. We've put a lot of effort into these, and they have video clips making the slide deck pretty big (why we're linking to it and not attaching it).
-
21:29
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Travis Rhodes Tags:
web application XSS Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn’t even the hard part, it’s keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90’s RFCs and 2010’s HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let’s never talk about that again. Ever. Take Facebook, Office 365, Wordpress, Exchange, and Live. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we’ll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks. The best description is probably via the slides linked below. We've put a lot of effort into these, and they have video clips making the slide deck pretty big (why we're linking to it and not attaching it).
-
21:29
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Travis Rhodes Tags:
web application XSS Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn’t even the hard part, it’s keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90’s RFCs and 2010’s HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let’s never talk about that again. Ever. Take Facebook, Office 365, Wordpress, Exchange, and Live. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we’ll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks. The best description is probably via the slides linked below. We've put a lot of effort into these, and they have video clips making the slide deck pretty big (why we're linking to it and not attaching it).
-
-
7:00
»
SecurityFocus Vulnerabilities
NGS00153 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Reflective XSS allowing an attacker to gain session tokens
-
-
13:19
»
SecDocs
Authors:
Artur Janc Tags:
web application XSS Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: XSS bugs are the most widely known and commonly occurring Web vulnerability, but their impact has often been limited to cookie theft and/or simple actions, such as setting malicious email filters, stealing some data, or self-propagation via an XSS worm. In this work, I discuss practical approaches for exploiting XSS and other client-side script injection attacks, and introduce novel techniques for maintaining and escalating access within the victim's browser. In particular, I introduce the concept of resident XSS where attacker-supplied code is running in the context of an affected user's main application window and describe its consequences. I also draw analogies between such persistent Web threats and the traditional rootkit model, including similarities in the areas of embedding malicious code, maintaining access, stealthy communication with a C&C server, and the difficulty of detecting and removing attacker-supplied code. Despite a few high profile cases of XSS worms, most XSS exploitation attempts have so far been limited to cookie-stealing and executing simple malicious actions. However, as a consequence of the same-origin policy and a combination of other browser mechanisms, a single XSS vulnerability can often lead to a long-term compromise all of a user's interactions with an affected webapp in the same browser profile, long after the original bug has been fixed. In particular, an attacker can maintain access across window/browser closures, survive cookie and cache deletions, and compromise other user accounts accessed from the same browser. Yet more troubling is the fact that Web application authors currently have no means to detect or mitigate such threats once an attack has taken place. In the talk I provide an overview of techniques to escalate an XSS into long-term account compromise, and explore the similarities between such persistent Web bugs and traditional rootkits. In particular, I: 1) Introduce the concept of resident XSS, where malicious JavaScript is executed in the context of the victim's main application window/tab. Contrary to the traditional methods of exploiting XSS via a hidden frame or malicious link which are opened in a separate, usually short-lived window, resident XSS gives an attacker full freedom to monitor and alter the user's interaction with the affected application. 2) Describe several techniques to convert various Web bugs into a resident XSS. Such techniques include backdooring client-side persistent storage mechanisms (WebSQL, localStorage, Flash LSOs), opening poisoned application windows with injected malicious scripts, exploiting persistent (self-)XSS and others. 3) Discuss the consequences of resident XSS, which usually allow the attacker to get permanent access to an affected user's account and/or obtain the user's application login credentials. On sensitive domains for which users have enabled access to additional browser or plugin features (geolocation, camera/microphone), it can enable persistent snooping on the exploited user. In a large number of cases it can also enable full compromise of the user's machine by exploiting the application-user trust relationship (e.g. by requiring the user to install attacker-supplied plugins to use the affected webapp, or by hijacking file download links within the vulnerable domain). 4) Analyze the techniques for maintaining access to a once-compromised origin. In addition to backdooring persistent storage APIs, this can be achieved by exploiting self-XSS bugs, spawning same-origin pop-unders with references to the original window, and hiding in frames created by advertising networks on popular websites. In most cases, a combination of those techniques suffices to bypass a variety of the most common "cleanup" actions taken by users, and allows an on-going compromise of the affected origin. 5) Present the difficulties faced by Web application authors when trying to clean up a compromised origin. Short of wiping/re-creating a browser profile, there are currently no fully reliable methods to restore a browser's state to a secure configuration once a malicious script has run in the context of an affected domain. I will present the above with concrete examples of vulnerable applications and a demo.
-
-
9:06
»
SecurityFocus Vulnerabilities
0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)
-
9:05
»
SecurityFocus Vulnerabilities
Re: Fwd: 0-DAY XSS of cforms II is now fixed after a year and four months (was Re: cforms WordPress Plugin Cross Site Scripting Vulnerability - CVE-2010-3977)
-
-
8:09
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Tags:
web application cookie vulnerability XSS Event:
Black Hat Abu Dhabi 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn't even the hard part, it's keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90's RFCs and 2010's HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let's never talk about that again. Ever. Take Facebook, Office 365, MSN, and Wordpress. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we'll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks.
-
8:09
»
SecDocs
Authors:
Jesse Ou Rich Lundeen Tags:
web application cookie vulnerability XSS Event:
Black Hat Abu Dhabi 2011 Abstract: Writing secure code is hard. Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn't even the hard part, it's keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90's RFCs and 2010's HTML5 compatible browsers. A lot like how Indiana Jones bridges the ancient and the modern... Except for Indiana Jones 4. Let's never talk about that again. Ever. Take Facebook, Office 365, MSN, and Wordpress. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we'll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks.
-
-
9:44
»
Packet Storm Security Advisories
Mandriva Linux Security Advisory 2011-198 - Multiple vulnerabilities has been found and corrected in phpmyadmin. Importing a specially-crafted XML file which contains an XML entity injection permits to retrieve a local file (limited by the privileges of the user running the web server). Using crafted database names, it was possible to produce XSS in the Database Synchronize and Database rename panels. Using an invalid and crafted SQL query, it was possible to produce XSS when editing a query on a table overview panel or when using the view creation dialog. Using a crafted column type, it was possible to produce XSS in the table search and create index dialogs. Crafted values entered in the setup interface can produce XSS; also, if the config directory exists and is writeable, the XSS payload can be saved to this directory. Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections. This upgrade provides the latest phpmyadmin version to address these vulnerabilities.
-
9:44
»
Packet Storm Security Recent Files
Mandriva Linux Security Advisory 2011-198 - Multiple vulnerabilities has been found and corrected in phpmyadmin. Importing a specially-crafted XML file which contains an XML entity injection permits to retrieve a local file (limited by the privileges of the user running the web server). Using crafted database names, it was possible to produce XSS in the Database Synchronize and Database rename panels. Using an invalid and crafted SQL query, it was possible to produce XSS when editing a query on a table overview panel or when using the view creation dialog. Using a crafted column type, it was possible to produce XSS in the table search and create index dialogs. Crafted values entered in the setup interface can produce XSS; also, if the config directory exists and is writeable, the XSS payload can be saved to this directory. Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections. This upgrade provides the latest phpmyadmin version to address these vulnerabilities.
-
9:44
»
Packet Storm Security Misc. Files
Mandriva Linux Security Advisory 2011-198 - Multiple vulnerabilities has been found and corrected in phpmyadmin. Importing a specially-crafted XML file which contains an XML entity injection permits to retrieve a local file (limited by the privileges of the user running the web server). Using crafted database names, it was possible to produce XSS in the Database Synchronize and Database rename panels. Using an invalid and crafted SQL query, it was possible to produce XSS when editing a query on a table overview panel or when using the view creation dialog. Using a crafted column type, it was possible to produce XSS in the table search and create index dialogs. Crafted values entered in the setup interface can produce XSS; also, if the config directory exists and is writeable, the XSS payload can be saved to this directory. Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections. This upgrade provides the latest phpmyadmin version to address these vulnerabilities.
-
-
15:23
»
Packet Storm Security Advisories
Bugzilla versions 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site scripting vulnerability. Versions 2.23.3 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from an unauthorized account creation vulnerability. Versions 2.0 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site request forgery vulnerability.
-
15:23
»
Packet Storm Security Recent Files
Bugzilla versions 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site scripting vulnerability. Versions 2.23.3 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from an unauthorized account creation vulnerability. Versions 2.0 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site request forgery vulnerability.
-
15:23
»
Packet Storm Security Misc. Files
Bugzilla versions 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site scripting vulnerability. Versions 2.23.3 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from an unauthorized account creation vulnerability. Versions 2.0 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 suffer from a cross site request forgery vulnerability.
-
-
13:33
»
SecDocs
Authors:
Shreeraj Shah Tags:
AJAX XSS Rich Internet Applications Event:
Black Hat USA 2010 Abstract: Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.
-
13:33
»
SecDocs
Authors:
Shreeraj Shah Tags:
AJAX XSS Rich Internet Applications Event:
Black Hat USA 2010 Abstract: Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.
-
-
19:04
»
SecuriTeam
Internet Explorer 9 has a security system with well known shortfalls, most notably that it does not attempt to address DOM based XSS or Stored XSS. This security system is built on an arbitrary philosophy which only accounts for the most straight forward of reflective XSS attacks. This paper covers three attack patterns that undermine Internet Explorer's ability to prevent Reflective XSS.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
14:00
»
SecurityFocus Vulnerabilities
[security bulletin] HPSBMU02692 SSRT100581 rev.2 - HP SiteScope, Remote Cross Site Scripting (XSS) and Session Fixation Attack
-
13:22
»
Packet Storm Security Advisories
HP Security Bulletin HPSBMU02692 SSRT100581 2 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely to allow cross site scripting (XSS) and session fixation attacks. Revision 2 of this advisory.
-
13:22
»
Packet Storm Security Recent Files
HP Security Bulletin HPSBMU02692 SSRT100581 2 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely to allow cross site scripting (XSS) and session fixation attacks. Revision 2 of this advisory.
-
13:22
»
Packet Storm Security Misc. Files
HP Security Bulletin HPSBMU02692 SSRT100581 2 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely to allow cross site scripting (XSS) and session fixation attacks. Revision 2 of this advisory.
-
8:17
»
Packet Storm Security Advisories
HP Security Bulletin HPSBMA02667 SSRT100464 3 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 3 of this advisory.
-
8:17
»
Packet Storm Security Recent Files
HP Security Bulletin HPSBMA02667 SSRT100464 3 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 3 of this advisory.
-
8:17
»
Packet Storm Security Misc. Files
HP Security Bulletin HPSBMA02667 SSRT100464 3 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 3 of this advisory.
-
12:21
»
Packet Storm Security Advisories
HP Security Bulletin HPSBMA02667 SSRT100464 2 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 2 of this advisory.
-
12:21
»
Packet Storm Security Recent Files
HP Security Bulletin HPSBMA02667 SSRT100464 2 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 2 of this advisory.
-
12:21
»
Packet Storm Security Misc. Files
HP Security Bulletin HPSBMA02667 SSRT100464 2 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 2 of this advisory.
-
-
10:02
»
Packet Storm Security Advisories
HP Security Bulletin HPSBMA02667 SSRT100464 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 1 of this advisory.
-
10:02
»
Packet Storm Security Recent Files
HP Security Bulletin HPSBMA02667 SSRT100464 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 1 of this advisory.
-
10:02
»
Packet Storm Security Misc. Files
HP Security Bulletin HPSBMA02667 SSRT100464 - Potential security vulnerabilities have been identified with HP SiteScope. These vulnerabilities could be exploited remotely via Cross Site Scripting (XSS) and HTML injection. Revision 1 of this advisory.
-
-
14:11
»
SecDocs
Authors:
Ryan C. Barnett Tags:
XSS Event:
Black Hat DC 2011 Abstract: Defending web applications from Cross-Site Scripting (XSS) attacks is extremely challenging, especially when the application's code can not be updated to fix the issue. This presentation will provide a walk-through of various XSS attack/defense/evasion lessons learned by Trustwave's SpiderLabs Research Team while working with commercial WAF customers, as well as, by receiving thousands of attacks against our public ModSecurity demonstration page. We will highlight cutting-edge XSS protection methods that are external to the web application's code such as Defensive Javascript Content Injection.
-
14:10
»
SecDocs
Authors:
Ryan C. Barnett Tags:
XSS Event:
Black Hat DC 2011 Abstract: Defending web applications from Cross-Site Scripting (XSS) attacks is extremely challenging, especially when the application's code can not be updated to fix the issue. This presentation will provide a walk-through of various XSS attack/defense/evasion lessons learned by Trustwave's SpiderLabs Research Team while working with commercial WAF customers, as well as, by receiving thousands of attacks against our public ModSecurity demonstration page. We will highlight cutting-edge XSS protection methods that are external to the web application's code such as Defensive Javascript Content Injection.
-
-
13:56
»
Packet Storm Security Advisories
HP Security Bulletin HPSBMA02650 SSRT100429 - Potential security vulnerabilities have been identified in HP Operations for UNIX. The vulnerabilities could be exploited remotely resulting in cross site scripting (XSS) or unauthorized access. Revision 1 of this advisory.
-
13:56
»
Packet Storm Security Recent Files
HP Security Bulletin HPSBMA02650 SSRT100429 - Potential security vulnerabilities have been identified in HP Operations for UNIX. The vulnerabilities could be exploited remotely resulting in cross site scripting (XSS) or unauthorized access. Revision 1 of this advisory.
-
13:56
»
Packet Storm Security Misc. Files
HP Security Bulletin HPSBMA02650 SSRT100429 - Potential security vulnerabilities have been identified in HP Operations for UNIX. The vulnerabilities could be exploited remotely resulting in cross site scripting (XSS) or unauthorized access. Revision 1 of this advisory.
-
-
17:17
»
Packet Storm Security Recent Files
Whitepaper called Exploitation of "Self-Only" Cross Site Scripting in Google Code. The author discusses how leveraging the use of clickjacking has enabled them to properly exploit a priorly non-exploitable cross site scripting issue in Google Code.
-
17:17
»
Packet Storm Security Misc. Files
Whitepaper called Exploitation of "Self-Only" Cross Site Scripting in Google Code. The author discusses how leveraging the use of clickjacking has enabled them to properly exploit a priorly non-exploitable cross site scripting issue in Google Code.
-
-
8:25
»
Packet Storm Security Exploits
LMS Web Ensino suffers from cross site request forgery, cross site scripting, session fixation, and remote SQL injection vulnerabilities.
Skip to page:
1
2
3
...
5