SQL injection vulnerability was discovered in Cotonti 0.9.13 (HTB23164). The vulnerability exists due to insufficient filtration of the "c" HTTP GET parameter passed to "index.php" script when HTTP GET "e" parameter is set to "rss". As a solution you can upgrade to Cotonti 0.9.14.
Multiple XSS vulnerabilities have been discovered in Jahia xCM version 6.6.1.0 r43343 by High-Tech Bridge Security Research Lab, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application.
The vulnerabilities exists due to insufficient sanitisation of user-supplied data in "site" HTTP GET parameter passed to "/engines/manager.jsp" script, "searchString" HTTP POST parameter passed to "/administration/" URI when "do=users" and "sub=search", "username", "manage-user-property#j:firstName", "manage-user-property#j:lastName", "manage-user-property#j:email" and "manage-user-property#j:organization" HTTP POST parameters passed to "/administration/" URI when "do=users" and "sub=processCreate". Risk level of this issues are Low, CVSSv2 Base Score=2.6
It is recommended to apply hotfix 7, that is available to all customers: hotfix 7.
Additional details provided here: www.htbridge.com/advisory/HTB23162.
Basic and visual security awareness initiation for brokers and insurers was presented at 4th brokers forum which occurred in Chavannes-de-Bogis by Frederic Bourla, some of the threats which could deadly impact brokers businesses.
YouTube videos:
Related links:
Ever since the Internet took off from its humble beginnings as a simple connection between the two networks of UCLA and Stanford for educational purposes, it has increasingly been used by the global population as a means of communication, commerce, charity and much more. The myriad ways of utilizing the Internet backbone all require software engineering of web-enabled applications (webapps). A new product from High-Tech Bridge SA called ImmuniWeb® performs webapp security assessments. If you’re like me, you’re probably thinking that this is just another webapp vulnerability scanner but hang on! It provides an innovative hybrid approach along with some really creative additional modules for assessing security beyond just the webapp. Why would we need such a hybrid approach? Read more at ethicalhacker.net.
In Q1 and Q2 of 2013 Cross-Site Scripting (XSS) was the most common vulnerability in web applications, SQL Injection took the second place, and Cross-Site Request Forgery the third one. During this period of time 65% of discovered vulnerabilities had medium risk, 20% had high risk. 95% of vendors released security patches before public disclosure of vulnerabilities. On average, vendors released security patches within 3 weeks after they were notified about discovered vulnerabilities. Read more at globalsecuritymag.com
