All Questions

-1
votes
0answers
116 views
+50

What are the latest same-origin bypasses in Flash Player about?

Looking for an example of such vulnerability in ActionScript 3, I quickly found: cve‑2014‑0580 cve‑2014‑0531 cve‑2014‑0533 cve‑2016‑7890 cve‑2015‑7628 In each case I was unable to gather further ...
58
votes
6answers
7k views
+50

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
0
votes
2answers
98 views
+50

How to create non-generic security requirements for an idea phase?

Our manager often asks us for a quick understanding of what the risks will be based on some idea that the department has been working on during the ideation phase (the business requirements are ...
2
votes
0answers
73 views
+50

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
3
votes
2answers
184 views
+100

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
1
vote
1answer
56 views
+50

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...