CVE-2010-2904: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the System Landscape Directory SLD component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter to testsdic and the 2 helpstring parameter to paramhelp.jsp...

New Study Sees Need for Better Software Integrity Controls

Software security has become one of the more widely discussed and debated topics in the security industry in the last few years, as many software vendors and enterprises both large and small have begun to to focus considerable attention on improving the processes they have in place for producing...

Is That a Bot In Your Pocket? Or Does It Just Look Like One?

Last week at the RSA Conference, my colleague Derek Brown and I, presented findings from a research project titled MOBOTS: Pocketful of Pwnage, which was designed to show how easy it would be to create a large mobile botnet. Please note that we did not actually create a botnet; we simply presente...

The 2010 Threat Landscape

Costin Raiu, chief security expert at Kaspersky Lab in Romania, discusses the state of the threat landscape for the year ahead, including botnets, malicious PDFs and targeted attacks. Please note: Raiu is referring to media reports that attackers may have stolen some of Adobe’s source code. Adobe...

Password Stealers Riding Along with DirectShow Exploits

On May 28, our colleagues at The Microsoft Security Response Center released advisory 971778 which elaborated on a new vulnerability in Microsoft DirectShow effecting Windows 2000, Windows XP and Windows Server 2003. You can obtain more details on how to protect your environment from this...

nicLOR Puglia Landscape (id) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications =============================================================== nicLOR Puglia Landscape id Local File Inclusion Vulnerability =============================================================== /...