The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
34 views

Advice on which approach to follow for sandboxing the input in an intentional “vulnerable” web app (sandbox in python) [duplicate]

my question is about which is the best approach/practice on building a "sandbox mechanism" in Python in a web application. The app will provide intentional vulnerable scenarios, and the user has to ...
0
votes
1answer
68 views

Buffer-overflow vulnerabilities that a static code analyser won't pick up [closed]

I'll use FlawFinder in this example. FlawFinder is a static code "analyser" tool that examines C/C++ source files and outputs warnings/hits if a vulnerability was identified. The way it does this is ...
2
votes
1answer
173 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
6
votes
0answers
83 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
1
vote
2answers
677 views

What is the story behind Java Vulnerabilities?

I always appreciated the Java language. It is known as a very secure platform and many banks use it in their web applications. I wanted to build a project for my school and I discussed the options ...
21
votes
9answers
2k views

Why is it so difficult to make C less prone to buffer overflows?

I'm doing a course in college, where one of the labs is to perform buffer overflow exploits on code they give us. This ranges from simple exploits like changing the return address for a function on a ...
5
votes
3answers
227 views

Examining source code for maliciousness and security vulnerabilities

What are some techniques in determining if a particular piece of source code is malicious or vulnerable to malicious attack? I am currently using cppcheck and I am waiting on an install of Rational ...
5
votes
3answers
1k views

What are the security risks/vulnerabilities every C programmer must be aware of?

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
4
votes
4answers
296 views

Small projects using the cathedral model: does open-source lower security?

We know of Linus' law: With enough eyeballs all bugs are shallow In general, people seem to say that open-source software is more secure because of that very thing, but... There are many small ...
34
votes
14answers
4k views

What to do if you find a vulnerability in a competitor's site?

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security ...
5
votes
5answers
893 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...