Mapping out Web apps attacks
35770
Attackers continue to use well-worn techniques, such as SQL injection, to exploit holes in popular Web applications but have also moved on to other targets, including government sites, and newer exploit methods, such as cross-site request forgery, according to the latest report filed by the Web Applications Security Consortium.
115827
Blog: Critical security flaw found in Firefox 2.0 and later versions potentially puts users' systems at risk of a remote attack.
620856
DevShed has a new book excerpt from a good standby security resource from O'Reilly - Chris Shiflett's "Essential PHP Security". This time, they focus on the chapter talking about sessions and cookie security.   This chapter discusses sessions and the inherent risks associated with stateful web applications. You will first learn the fundamentals of state, cookies, and sessions; then I will discuss several concerns - cookie theft, exposed session data, session fixation, and session hijacking-along with practices that you can employ to help prevent them.   The chapter talks about how the statelessness of HTTP causes problems, how cookies can be stolen because of it and what kinds of things you can do to keep you and your users safe (like session fixation).
437595
Hackers can drop malicious code into systems running Firefox when the browser is armed with Google Toolbar, Yahoo Toolbar, or other add-ons.
386296
The facts of web servers don't necessarily match the myths when it comes to security.
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
620116
The cross-site scripting technique used by many malware propagators has branched out into a troubling new area of endeavor, as XSS attacks are turning up that inject child pornography into Web forums. One attack targeted a kids' site.
90728
A new variant of the Santy worm, which attacks Web pages usuing the PHP bulletin board software, appeared this week. Earlier variants used Google to find vulnerable Web pages; the new
664907
A month of browser bugs &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
605863
com staff. Danish security firm Secunia has reported a &quot;moderately critical&quot; window injection vulnerability in Firefox, Internet Explorer, Opera, Netscape, Safari and Konqueror.
239180
User-generated Web content is becoming a target for hackers and cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites.
189807
Browser flaw may leave you vulnerable to phishing attacks.
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
226377
Blog: Security researchers discover critical vulnerabilities in LinkedIn IE toolbar, further raising concerns malicious attackers may use a published working exploit to take advantage of the flaws.
691931
Several major websites are brought down by the largest denial-of-service attacks ever staged. Compiled by Tony Long.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.