NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
Cross-Site Scripting (XSS) - The Internet is Definitely a More Dangerous Place
Phishing schemes are about to get a whole lot easier. Targeted attacks are much more likely to work now than ever before. Cookies stored on your computer can be retrieved by bad guys half a world away. Even big search engine companies like Google and Yahoo are shaking in their boots. What happened? The bad guys have discovered Cross-Site Scripting (XSS) and the Internet has sudden become a lot more dangerous. (updated with screen shots)No Longer Supported

[ Read the rest of the article... ]
Posted by NIST.org on Monday 09 October 2006 - 15:35:01 | |printer friendly
Translate to: {GOOGLETRANS}
Google Ads




Headlines

»CVE-2011-5320
scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (seg ...
»CVE-2012-4379
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP h ...
»CVE-2012-4380
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking e ...
»CVE-2012-4382
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, whi ...
»CVE-2012-6707
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for ...
»CVE-2014-0029
Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-he ...
»CVE-2014-0208
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman befo ...
»CVE-2014-2277
The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain ...
»CVE-2014-2664
Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protect ...
»CVE-2014-2903 (wolfssl)
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to ...
»CVE-2014-3164
cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f32 ...
»CVE-2014-3531
Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticat ...
»CVE-2014-3702
Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary di ...
»CVE-2014-3706
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by lever ...
»CVE-2014-3709
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Fi ...


Date published: 2017-10-20T18:00:08Z
Details

»Cisco Releases Security Updates
Original release date: October 18, 2017 Cisco has released updates to address vulnerabilities ...
»Google Releases Security Updates for Chrome
Original release date: October 18, 2017 Google has released Chrome version 62.0.3202.62 for W ...
»Oracle Releases Security Bulletin
Original release date: October 17, 2017 Oracle has released its Critical Patch Update for Oct ...
»IC3 Issues Alert on DDoS Attacks
Original release date: October 17, 2017 The Internet Crime Complaint Center (IC3) has issued ...
»IC3 Issues Alert on IoT Devices
Original release date: October 17, 2017 In conjunction with National Cyber Security Awareness ...
»Today’s Predictions for Tomorrow’s Internet
Original release date: October 17, 2017 October is National Cybersecurity Awareness Month, an ...
»Adobe Releases Security Updates
Original release date: October 16, 2017 Adobe has released security updates to address a vuln ...
»CERT/CC Reports WPA2 Vulnerabilities
Original release date: October 16, 2017 CERT Coordination Center (CERT/CC) has released infor ...
»Mozilla Releases Security Update
Original release date: October 11, 2017 Mozilla has released a security update to address mul ...
»Microsoft Releases October 2017 Security Updates
Original release date: October 10, 2017 Microsoft has released updates to address vulnerabili ...


Date published: not known
Details

»VB2017 paper: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell
We publish the VB2017 paper and video by Kaspersky Lab researchers ...
»Didn't come to VB2017? Tell us why!
Virus Bulletin is a company - and a conference - with a mission: to ...
»Montreal will host VB2018
Last week, we announced the full details of VB2018, which will take ...
»VB2017 preview: Beyond lexical and PDNS (guest blog)
In a special guest blog post, VB2017 Silver sponsor Cisco Umbrella ...
»Avast to present technical details of CCleaner hack at VB2017
The recently discovered malicious CCleaner version has become one o ...
»VB2017 preview: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell
We preview the VB2017 paper by Kaspersky Lab researchers Juan André ...
»VB2017 preview: Offensive malware analysis: dissecting OSX/FruitFly.B via a custom C&C server
We preview Patrick Wardle's VB2017 paper, in which the Synack resea ...
»VB2017 - information for press
More than 50 security industry experts will present conference pape ...
»VB2017 preview: BPH exposed - RBN never left they just adapted and evolved. Did you?
We preview the VB2017 paper by Dhia Mahjoub (OpenDNS) and Jason Pas ...


Date published: not known
Details
Main Menu
· Home
Current Security News
 
US-CERT Current Activity

» Cisco Releases Security Updates
[18 Oct 2017 02:07pm]

» Google Releases Security Updates for Chrome
[18 Oct 2017 08:08am]

» Oracle Releases Security Bulletin
[17 Oct 2017 06:40pm]

» IC3 Issues Alert on DDoS Attacks
[17 Oct 2017 06:39pm]

» IC3 Issues Alert on IoT Devices
[17 Oct 2017 04:56pm]

» Today’s Predictions for Tomorrow’s Internet
[17 Oct 2017 05:24am]

» Adobe Releases Security Updates
[16 Oct 2017 01:33pm]

» CERT/CC Reports WPA2 Vulnerabilities
[16 Oct 2017 07:20am]

» Mozilla Releases Security Update
[11 Oct 2017 08:25am]

» Microsoft Releases October 2017 Security Updates
[10 Oct 2017 01:37pm]

***
US-CERT Alerts

» TA17-293A: Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors
[20 Oct 2017 04:50pm]

» TA17-181A: Petya Ransomware
[30 Jun 2017 11:41pm]

» TA17-164A: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
[13 Jun 2017 09:45am]

» TA17-163A: CrashOverride Malware
[12 Jun 2017 03:44pm]

» TA17-156A: Reducing the Risk of SNMP Abuse
[05 Jun 2017 06:11pm]

» TA17-132A: Indicators Associated With WannaCry Ransomware
[12 May 2017 07:36pm]

» TA17-117A: Intrusions Affecting Multiple Victims Across Multiple Sectors
[27 Apr 2017 04:50pm]

» TA17-075A: HTTPS Interception Weakens TLS Security
[16 Mar 2017 06:40am]

» TA16-336A: Avalanche (crimeware-as-a-service infrastructure)
[30 Nov 2016 10:00pm]

» TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets
[14 Oct 2016 05:59pm]

***
Computerworld Security

» Anatomy of a spambot
[19 Oct 2017 04:00am]

» What is blockchain? Get up to speed with this video primer
[18 Oct 2017 11:00pm]

» 48% off Kidde Carbon Monoxide Alarm with Display and 10 Year Battery - Deal Alert
[18 Oct 2017 07:32am]

» 4 old malware threats still haunting business today
[17 Oct 2017 10:00pm]

» Excel, Access, external DB driver errors linked to this month’s patches
[17 Oct 2017 09:08am]

» Amazon wants to deliver groceries to your car trunk — not a good idea
[17 Oct 2017 04:00am]

» Microsoft shuts down Krack with sneaky Windows update
[16 Oct 2017 02:44pm]

» Don’t be the fool in the cloud
[16 Oct 2017 08:23am]

» Learn the ins and outs of Europe's General Data Protection Regulation (GDPR)
[15 Oct 2017 11:00pm]

» FinTech builds on blockchain for international mobile payments
[15 Oct 2017 10:07pm]

» Microsoft's anti-malware sniffing service powers Edge to top spot in browser blocking tests
[14 Oct 2017 01:58pm]

» Early reports of myriad Microsoft Patch Tuesday problems
[11 Oct 2017 05:28am]

» Another banner Patch Tuesday, with a Word zero-day and several bugs
[10 Oct 2017 02:28pm]

» In iOS 11, toggling Wi-Fi and Bluetooth 'off' doesn’t work. Here’s why.
[10 Oct 2017 01:54pm]

» Microsoft sunsets Windows 10's first feature upgrade
[10 Oct 2017 11:34am]

***
Microsoft Security Advisories

» 4038556 - Guidance for securing applications that host the WebBrowser Control - Version: 1.0
[08 Aug 2017 11:00am]

» 4033453 - Vulnerability in Azure AD Connect Could Allow Elevation of Privilege - Version: 1.0
[27 Jun 2017 11:00am]

» 4025685 - Guidance related to June 2017 security update release - Version: 1.0
[13 Jun 2017 11:00am]

» 4022345 - Identifying and correcting failure of Windows Update client to receive updates - Version: 1.3
[12 May 2017 11:00am]

» 4022344 - Security Update for Microsoft Malware Protection Engine - Version: 1.2
[12 May 2017 11:00am]

» 4021279 - Vulnerabilities in .NET Core, ASP.NET Core Could Allow Elevation of Privilege - Version: 1.1
[10 May 2017 11:00am]

» 4010323 - Deprecation of SHA-1 for SSL/TLS Certificates in Microsoft Edge and Internet Explorer 11 - Version: 1.0
[09 May 2017 11:00am]

» 3123479 - SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[14 Mar 2017 11:00am]

» 4010983 - Vulnerability in ASP.NET Core MVC 1.1.0 Could Allow Denial of Service - Version: 1.0
[27 Jan 2017 11:00am]

» 3214296 - Vulnerabilities in Identity Model Extensions Token Signing Verification Could Allow Elevation of Privilege - Version: 1.0
[10 Jan 2017 11:00am]

» 3181759 - Vulnerabilities in ASP.NET Core View Components Could Allow Elevation of Privilege - Version: 1.0
[13 Sep 2016 11:00am]

» 3174644 - Updated Support for Diffie-Hellman Key Exchange - Version: 1.0
[13 Sep 2016 11:00am]

» 3179528 - Update for Kernel Mode Blacklist - Version: 1.0
[09 Aug 2016 11:00am]

» 2880823 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[18 May 2016 11:00am]

» 3155527 - Update to Cipher Suites for FalseStart - Version: 1.0
[10 May 2016 11:00am]

***
Security Latest

» Russian Spies Rush to Exploit the Latest Flash Zero Day and More Security News This Week
[21 Oct 2017 06:00am]

» The Reaper Botnet Could Be Worse Than the Internet-Shaking Mirai Ever Was
[20 Oct 2017 03:45pm]

» Equifax Deserves the Corporate Death Penalty
[20 Oct 2017 06:00am]

» Cryptojacking Lets Strangers Mine Cryptocurrency With Your Browser
[20 Oct 2017 05:00am]

» It Takes Just $1,000 to Track Someone's Location With Mobile Ads
[18 Oct 2017 05:00am]

» Why the Krack Wi-Fi Mess Will Take Decades to Clean Up
[17 Oct 2017 01:39pm]

» The Flawed System Behind the Krack Wi-Fi Meltdown
[17 Oct 2017 10:55am]

» Google's 'Advanced Protection' Locks Down Accounts Like Never Before
[17 Oct 2017 05:00am]

» KRACK Vulnerability Makes Wi-Fi Hacking Possible, Leaving Millions of Devices Exposed
[16 Oct 2017 09:03am]

» Trump Decertifying the Iran Deal Could Have Unseen Cyberattack Consequences
[15 Oct 2017 05:00am]

» An Equifax Goof, an iOS Phish, and More Security News This Week
[14 Oct 2017 06:00am]

» How Power Grid Hacks Work, and When You Should Panic
[13 Oct 2017 10:00am]

» How To Fix the Broken Social Security Number Sytem
[13 Oct 2017 05:00am]

» Kaspersky's Alleged Russia Ties Highlight the Risks of Antivirus
[11 Oct 2017 03:01pm]

» 'Crypto Anchors' Might Stop the Next Equifax-Style Megabreach
[11 Oct 2017 10:45am]

***
Network World Security

» 48% off Kidde Carbon Monoxide Alarm with Display and 10 Year Battery - Deal Alert
[18 Oct 2017 07:32am]

» How to speed up IoT deployment: Give each device an identity
[12 Oct 2017 03:30am]

» What is a firewall?
[11 Oct 2017 02:16pm]

» IDG Contributor Network: How smart cities can protect against IoT security threats
[11 Oct 2017 05:00am]

» 7 free tools every network needs
[15 Aug 2017 01:52pm]

» Gravityscan, keeping WordPress sites safe
[24 May 2017 02:34pm]

» Network monitoring tools: Features users love and hate
[01 May 2017 04:51am]

» Book Review: Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems
[27 Apr 2017 12:45pm]

» Fight firewall sprawl with AlgoSec, Tufin, Skybox suites
[10 Apr 2017 04:32am]

» Review: Canary Flex security camera lives up to its name
[24 Mar 2017 07:01am]

» Zix wins 5-vendor email encryption shootout
[13 Mar 2017 04:00am]

» Review: vArmour flips security on its head
[06 Mar 2017 03:50am]

» 5 open source security tools too good to ignore
[21 Feb 2017 07:12am]

» What is blockchain? Get up to speed with this video primer
[18 Oct 2017 11:00pm]

» 4 old malware threats still haunting business today
[17 Oct 2017 10:00pm]

***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf
Welcome
Username:

Password:




Remember me

[ ]

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}