The Effect of Snake Oil Security

I’ve talked about this a few times over the years during various presentations but I wanted to document it here as well. It’s a concept that I’ve been wrestling with for 7+ years and I don’t think I’ve made any headway in convincing anyone, beyond a few head nods. Bad security isn’t just bad...

CVE-2010-2457: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in K-Search allows remote attackers to inject arbitrary web script or HTML via the term parameter...

SchoolMation 2.3 - SQL Injection / Cross-Site Scripting

==================================================== SchoolMation Version 2.3 SQLi and XSS Vulnerability ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //...

CVE-2010-1984: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Taxonomy Breadcrumb module 5.x before 5.x-1.5 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with administer taxonomy permissions, to inject arbitrary web script or HTML via the taxonomy term name in a Breadcrumb display...

RHEL 5 : openldap (RHSA-2010:0198)

Updated openldap packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Cross site scripting

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

CVE-2010-1362

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

CVE-2010-1362

CVE-2010-1362 is an XSS vulnerability in the Drupal Own Term module 6.x-1.0. Remote authenticated users with "create additional terms" privileges can inject arbitrary script or HTML via the term description field on a term listing page. Impact is partial on integrity (XSS) with no confidentiality...

CVE-2010-1362

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

CVE-2010-1362: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

SA-CONTRIB-2010-005 - Own Term - Cross site scripting

The Own Term module allows users to create taxonomy terms in a designated vocabulary and when creating content this term is automatically added to the node. The module does not sanitize the term description on a term listing page which opens a cross-site scripting XSS attack. Users with a role...

Q&A: Eugene Spafford on Cybercrime, Security Research

Threatpost editor Dennis Fisher talks with Eugene Spafford of Purdue’s CERIAS center about cybercrime, funding for long-term security research projects and whether the federal cybersecurity coordinator position matters. Fisher: Do you see any indications that there will be more funding coming fro...

New Security Consortium to Focus on Long-Term Projects

The three universities involved in the security consortium put together this week by Northrop Grumman will have wide latitude to pursue research projects as they see fit and will be under no obligation to work only on technology that fits Northrop’s future plans. The researchers, in fact, will be...

CVE-2009-3202: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refinebytaxo when displaying tags...

CVE-2008-7150: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refinebytaxo when displaying tags...

Sql injection

Multiple SQL injection vulnerabilities in index.php in MIM:InfiniX 1.2.003 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters in a calendar action, or 3 a search term in the search form...

PT-2009-4532 · Drupal · Drupal Taxonomy Manager

Name of the Vulnerable Software and Affected Versions: Drupal Taxonomy manager versions 5.x before 5.x-1.2 Drupal Taxonomy manager versions 6.x before 6.x-1.1 Description: A cross-site scripting XSS issue exists in the administrative page interface of the Taxonomy manager module for Drupal. This...

CVE-2009-2079: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to injec...

CVE-2009-0540

Libero CVE-2009-0540 is an XSS vulnerability in Libero 5.3 SP5 (and possibly versions before 5.5 SP1) that allows remote attackers to inject arbitrary web script via the search term field. The issue arises from insufficient input filtering/sanitisation of HTML tags in the web app, and is categori...