Tag Info

New answers tagged

1

You would be very lucky to find a case where you can directly execute code via a simple coding error in Java. It is possible that a bug in the implementation of the JVM allows memory corruption through benign code, but at worst phenomenally rare. However, even within the JRE (OpenJDK) a portion of the libraries are written in C, and therefore contain memory ...


0

Common Java security flaws include: Injection attacks - SQL injection, cross-site scripting, XPath injection, XML external entity, and many more. I'm aware of about 20 different kinds of injection. Business logic flaws - Parameter tampering, forced browsing, negative numbers accepted, etc. Authentication and session flaws - No account lockouts, session ...


1

One option is exploiting the JVM itself - it may be possible to have java code that causes the actual virtual machine to 'break' and execute arbitrary operations outside of the sandbox; there have been such exploits, although they seem to rely on sending the victim some java code for execution (i.e., in a browser sandbox context), not exploiting random java ...


1

The short answer would be "all the rest of them", but not including the simplistic kinds of errors from exploiting raw memory buffer overflows. There are plenty of other ways that memory could be used incorrectly without overrunning a buffer. An example something that might be classified as a buffer overflow problem in java would be if the application ...


2

When you go to http://get.adobe.com/flashplayer/, it will forward you to http://get.adobe.com/**/flashplayer/ where ** is the two-letter code of the preferred language according to your browsers headers. You can then change this from http to https to get the encrypted version, which will have a https link to the latest flash installer. By the way: When you ...


-2

Why does the Adobe download site need to use SSL? Do you need the flash update to be encrypted? SSL doesn't make a site secure. You can download all kinds of malware and exploited content from an SSL connection, it's just that other people won't be able to see it. If there is no sensitive information to be obtained by downloading a flash player update from ...



Top 50 recent answers are included