2
votes
1answer
448 views

Why is “MIME type mismatch on image file” a security vulnerability?

Some security vulnerability scanners as Ratproxy detects a vulnerability called "MIME type mismatch on image file". Thanks to the CAPEC project we can see that Cross-Site Scripting Using MIME Type ...
4
votes
1answer
123 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...