How to Secure Web Apps Against XSS Flaws

As a security researcher, I regularly come across software vulnerabilities. Some can have a deep and lasting effect on the way customers and clients view the security of the organization and some can have a fairly minimal impact. However, when there are applications susceptible to a few basic typ...

OpenJDK: NetworkInterface information leak (Networking, 7013969)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors relate...

Zynga Petville Cross Site Scripting

\ \ \ \ \ | / \ \ \ / /\ / /\ \ / / |/ /| | / / \ / / / | | /\ / \ / / /| SUG: HTML encoding, escaping special characters,Input sanitization...

Zynga Cafeworld Cross Site Scripting

\ \ \ \ \ | / \ \ \ / /\ / /\ \ / / |/ /| | / / \ / / / | | /\ / \ / / /| alert"r007k17-w" SUG: HTML encoding, escaping special characters,Input sanitization...

Zynga Vampiresgame Cross Site Scripting

\ \ \ \ \ | / \ \ \ / /\ / /\ \ / / |/ /| | / / \ / / / | | /\ / \ / / /| Author: r007k17-w a.k.a Raghavendra Karthik.D Email: [email protected] My blog: http://shadowrootkit.wordpress.com/ Google Dork: Copyright 2010 Zynga Game Network Inc...

Android Malware Increasing, AutoRun Attacks Still Prevalent

The recent trend of attackers focusing their attention on mobile platforms such as Android, Symbian and iOs is continuing to accelerate, researchers say, and the threats to smartphones are becoming more and more sophisticated and dangerous. Android is becoming the focus of much of the attention...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection SEP 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via 1 the token parameter to portal/Help.jsp or 2 the URI in a...

How the Google-Motorola Deal May Affect Android Security

By B.K. DeLong With this morning’s acquisition of Motorola Mobility, Google has made the move to bring in a solid hardware component for their Android mobility platform and fired another shot across the bow of Apple. But one big questions remains: What does this acquisition mean for those trying ...

OpenJDK: MediaTracker created Component instances with unnecessary privileges (Swing, 7020198)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availabili...

OpenJDK: Deserialization allows creation of mutable SignedObject (Deserialization, 6618658)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to...

Miscode Blind SQL Injection

. . . . | | | / || \ \ | / | | / \ / | / \ / \ / \ / /| |\ \ / \ / \ / / \ / | / \ \ \ | || | / // | | | \ / \ \ | | / | | \ \ / // | \ / | | / |||| /\ | / || / \ / || /|| / \ / / \ | \ || / / / / / / / / / /...

CVE-2011-0550: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection SEP 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via 1 the token parameter to portal/Help.jsp or 2 the URI in a...

E-SolBiz =>SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

E-SolBiz SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Securing Mobile Devices May Be an Impossible Task

LAS VEGAS–The way that things are right now in mobile security, there does not look to be much hope for keeping corporate and personal data secure. A panel of researchers who focus on looking for attacks and bugs at various levels of the mobile device and infrastructure said at Black Hat that the...

MyBB MyTabs SQL Injection

===================================================================== MyBB 0day \ MyTabs plugin SQL injection vulnerability ===================================================================== Exploit title : MyBB 0day \ MyTabs plugin SQL injection vulnerability. Author: AutoRUN & dR.sqL Home :...

SiteGenius - Blind SQL Injection

SiteGenius - Blind SQL Injection ===================================================== SiteGenius Blind SQL injection vulnerability ===================================================== Exploit title : SiteGenius Blind SQL injection vulnerability Date : 02 \ 08 \ 2011 Author : AutoRUN & dR.sqL Ho...

SiteGenius - Blind SQL Injection

===================================================== SiteGenius Blind SQL injection vulnerability ===================================================== Exploit title : SiteGenius Blind SQL injection vulnerability Date : 02 \ 08 \ 2011 Author : AutoRUN & dR.sqL Home : HackForums.AL ,...

MyBB MyTabs Plugin - SQL Injection

===================================================================== MyBB 0day \ MyTabs plugin SQL injection vulnerability ===================================================================== Exploit title : MyBB 0day \ MyTabs plugin SQL injection vulnerability. Author: AutoRUN & dR.sqL Home :...

SiteGenius Blind SQL injection Vulnerability

Exploit for php platform in category web applications ===================================================== SiteGenius Blind SQL injection vulnerability ===================================================== Exploit title : SiteGenius Blind SQL injection vulnerability Date : 02 \ 08 \ 2011 Author ...