Tag Info

New answers tagged

2

It's a bad idea to host a database server on your internet facing webserver. If the underlying OS of your web/DB server, or webserver platform itself contains any vulnerabilities that can be exploited then your database will be compromised. I won't be broadcasting the IP address of my database because I won't be sending calls to it, which makes my ...


1

Think of the scenarios of compromise. If you host the database on the same system as the web service, then a compromise of the web service results in immediate compromise of the database. So, this is minimally secure. If you host the database on an "internal" server that the web service can access (via an internally facing network interface or special ...


0

I won't be broadcasting the IP address of my database because I won't be sending calls to it, which makes my database inaccessible to the outside world Not knowing an IP address does not make something in that address inaccessible. In an analogy it is a house without a street address. If a thieve walks by that house, he can still enter the door. In ...


1

There seems to be something wrong with the request you posted. Since the vulnerable parameter is the "cat" parameter the "&" in your request separates the payload from the vulnerable parameter thus resulting in no information being revealed. Let us do it right: A request for: ...


2

Oracle Virtual Private Database (VPD) is provided at no additional cost with the Enterprise Edition of Oracle Database. Oracle Label Security is an add-on security option for the Oracle Database Enterprise Edition. Oracle VPD is a term used for several powerful security features like, fine grained access control (FGAC), application context and global ...


0

It means that DotEasy has a bad password strength rating system. If I recall correctly they are a pretty cut rate hosting platform. If you are looking for something dirt cheap they are probably the way to go. If you are looking for quality, you might look into a more expensive/respected hosting provider. Best of luck!


6

It is a security issue, and tampering with headers, or really, anything that you have on the client side is very easy. You should never trust anything that coming from the client. I would definitively suggest that you have a white list of acceptable values that is enforced on the server side to avoid SQL injections. This list could be generated ...


7

This is not a good idea. An attacker could change the database name, supply an invalid one, or put special chars on the database name and possibly exploit a SQL injection. It's possible to do a lot of damage depending on your setup. You could use server-side sessions, and send only the session token to the user. The database he is connecting to should be ...


2

If all you are passing over is a simple name which identifies a database to use, then I can't see any immediate problems (provided you do some server side validation). I would try to avoid using names that give away more info about the database than needed though (e.g. server addresses, system- or version-info, etc). In fact, it might be better to just use ...


1

It depends on the bank's security in general. Europe is better than the US, but there are stories of forged debits in the UK as well where they only used basic information. If you are worried about routing numbers and account numbers (as leaking a database can be a PR nightmare regardless if the info regards financial information), you could opt for a ...


3

effective in securing it from this kind of theft? Threats against credit card information while shopping online are diverse. I would say that your proposal is effective (as oppose to having no effect whatsoever), but the overall threat reduction is small. This technique might be effective in partially mitigating some of the following threats: ...



Top 50 recent answers are included