Security Experts Expose Costly Vulnerability in Second Life

Sunday, December 2nd, 2007

Second Life users need to be cautious with Quicktime embedded videos in the game as it may be used to pick your pocket of Linden Dollars. Charles Miller and Dino Dai Zovi, of Independent Security Evaluators, have found that by using a flaw in Quicktime, they can not only pick the ...

Posted in mashable.com | No Comments »

The Adobe PDF XSS Vulnerability

Wednesday, January 10th, 2007

I've been concentrating on work this past week, but I wanted to quickly mention the Adobe PDF XSS vulnerability discovered by Stefano Di Paola and Giorgio Fedon. This is being called UXSS (universal cross-site scripting) due to the fact that it can aff...

Posted in shiflett.org | No Comments »

YouTube Fixes Security Vulnerability

Thursday, December 21st, 2006

Until recently, YouTube has been vulnerable to cross-domain Ajax attacks due to their open crossdomain.xml policy. I notified them as soon as I discovered the vulnerability, and although I have yet to receive a reply, it appears they have fixed the pro...

Posted in shiflett.org | No Comments »

Another Google XSS Vulnerability

Thursday, March 2nd, 2006

I don't want to provide any links or details before it is fixed, but Google has another cross-site scripting (XSS) vulnerability. It is more serious than the previous one, because: It works with any character encoding. (You can be a victim even ...

Posted in shiflett.org | No Comments »

Google’s Cross-Site Scripting Vulnerability

Wednesday, December 21st, 2005

I'm sure this will be getting some attention, because everything Google does gets attention. :-) The recent cross-site scripting (XSS) vulnerability discovered in Google perfectly illustrates why character encoding matters. This example demonstrates h...

Posted in shiflett.org | No Comments »

PEAR XML_RPC Vulnerability and PHP 4.4.0RC2 release

Tuesday, August 16th, 2005

An easily exploitable security issue was discovered in PEAR XML_RPC <= 1.3.0. We recommend that users of this PEAR class immediately upgrade to the latest version with: pear upgrade XML_RPC The same security problem exists in many other XML RPC implementations, please check if the installed applications that you use ...

Posted in php.net | No Comments »