Skip to main content

All Questions

Tagged with
3 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
2 answers
355 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients. While the image formats are ...
DividedByZero's user avatar
3 votes
1 answer
393 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
user avatar
1 vote
0 answers
429 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way out ...
tis's user avatar
  • 275