Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability
Bugtraq ID: 70654
Class: Input Validation Error
CVE: CVE-2014-7292
Remote: Yes
Local: No
Published: Oct 20 2014 12:00AM
Updated: Oct 20 2014 12:00AM
Credit: Wang Jing
Showing posts with label Web Flaw. Show all posts
Showing posts with label Web Flaw. Show all posts
Monday, 29 December 2014
CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities
CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities
Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities
Product: WebPress
Vendor: goYWP
Vulnerable Versions: 13.00.06
Tested Version: 13.00.06
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8751
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]
Advisory Details:
(1) Product
“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself.”
(2) Vulnerability Details:
goYWP WebPress has a security problem. It is vulnerable to XSS attacks.
(2.1) The first security vulnerability occurs at “/search.php” page with “&search_param” parameter in HTTP GET.
(2.2) The second security vulnerability occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.
References:
Wednesday, 1 October 2014
Vigilantes testing security of IT systems
SINGAPORE: Call them cybersecurity vigilantes if you will, or “white hats” - as they are known in the hacking world.
Mr
Wang Jing and Mr Zhao Hainan are part of a growing group of individuals
who are taking it upon themselves to test the security of information
systems in organisations and report security flaws.
Earlier this month, Mr Zhao, 26, a National University of Singapore computer science postgraduate student, managed to hack into M1’s pre-order site for
the iPhone 6 and 6 Plus to access personal data, including phone and
NRIC numbers, as well as home addresses of the telco’s customers. He
then alerted the company.
M1,
which temporarily suspended all pre-orders to carry out an
investigation, said it appreciated the fact that Mr Zhao, who was not
identified in previous media reports, had taken the time to inform the
firm about the potential security flaw and would not be taking any
action against him.
Speaking
to TODAY, Mr Zhao, a Singapore permanent resident, said his interest in
hacking began after he had taken a module on website security. He added
that he makes sure he does not break any laws and would report any
vulnerabilities he discovered to website owners.
“I
want to make the Internet a safer place. So, over the years, I will try
to hack (into) a website when I feel interested in (it) … I also do it
out of curiosity,” he said.
For
Mr Wang, who is pursuing a PhD in mathematics at Nanyang Technological
University’s School of Physical and Mathematical Sciences, testing
websites for vulnerabilities is a hobby he started early this year.
After
reading up on computer security, he tested some well-known social
networking sites, as well as websites of banks here and other popular
Singapore-based sites.
“I
believe making the Web more secure is beneficial to users … I am happy
to do something that is useful,” said Mr Wang, who is in his 20s.
Apart
from individuals, there are also groups of cybersecurity watchdogs,
including the 400-member Singapore Security Meetup Group.
Led
by Infotect Security managing director Wong Onn Chee, the informal
group comprises cybersecurity experts. They do not do penetration
testing of websites, as this could potentially run afoul of laws if it
is unauthorised.
Mr
Wong said the group members have informed organisations when they came
across websites using technology or carrying out transactions that were
highly suspected to be vulnerable.
Mr
Anthony Lim, a member of the Application Security Advisory Board at
ISC2, a not-for-profit association for information security
professionals, cautioned against individuals performing “ethical
hacking”.
“We
don’t want anonymous ‘superhero-wannabe’ types … running around loose
in cyberspace trying to do good by quietly hacking into your system
without your prior knowledge and approval … even if they don’t cause any
damage or steal any data,” he said.
- TODAY
Reference:
Subscribe to:
Posts (Atom)