Blogs

Skype Confirms XSS Vulnerability in iPhone App

http://www.h-online.com/security/news/item/Skype-confirms-XSS-vulnerabil...

"An XSS bug in the iPhone and iPad version of the Skype client, in combination with an incorrect WebKit setting, allows an attacker to directly access files on the device, including the user's Address Book. The XSS bug itself is an incorrect encoding of the incoming user's 'Full Name' which allows JavaScript code to be embedded in it."

phpMyAdmin Multiple Script Insertion Vulnerabilities PMASA-2011-14

http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php

"Firstly, if a row contains javascript code, after inline editing this row and saving, the code is executed. Secondly, missing sanitization on the db, table and column names leads to XSS vulnerabilities."

Please respond back to this ticket if you found this security alert helpful.

Security updates available for Adobe Reader and Acrobat

http://www.adobe.com/support/security/bulletins/apsb11-24.html

"Critical vulnerabilities have been identified in Adobe Reader X (10.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.2 and earlier versions for UNIX, and Adobe Acrobat X (10.1) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system."

phpMyAdmin updates close XSS hole

http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html

"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."

phpMyAdmin updates close XSS hole

http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html

"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."

Apache kill tool released

http://www.zdnet.com/blog/security/kill-tool-released-for-unpatched-apac...

A simple perl script run against an unpatched Apache server could lead
to a Denial of Service (DoS) attack against the server. It causes the
Apache process to spiral out of control, consuming CPU and Memory on the
Host and in some cases, stops entirely.

During the attack, web pages served by the Apache process are slow or
non existent.

Apache kill tool released

http://www.zdnet.com/blog/security/kill-tool-released-for-unpatched-apac...

A simple perl script run against an unpatched Apache server could lead
to a Denial of Service (DoS) attack against the server. It causes the
Apache process to spiral out of control, consuming CPU and Memory on the
Host and in some cases, stops entirely.

During the attack, web pages served by the Apache process are slow or
non existent.

Pages