User bobince

4 votes

How about preventing CSRF this way?

answered Oct 3, 2013 at 10:46

2 votes

What information can be seen from HTTPS to HTTP?

answered Sep 25, 2013 at 9:54

3 votes

Flash ignores Content-Type header, allowing XSS?

answered Sep 25, 2013 at 9:33

3 votes

Accepted

Calling JavaScript functions from within a Style tag XSS

answered Sep 17, 2013 at 7:54

2 votes

Malware Suddenly Uploaded To My Website!

answered Sep 16, 2013 at 20:42

2 votes

Accepted

XSS prevention for RESTful services

answered Sep 10, 2013 at 9:08

61 votes

Accepted

Is the Web browser status bar always trustable?

answered Aug 30, 2013 at 8:35

3 votes

Accepted

Need help deciphering malicious JS code

answered Aug 28, 2013 at 8:47

8 votes

What are the security implications of the POLi Internet Payments technique?

answered Aug 20, 2013 at 13:08

3 votes

Javascript containing a long hexadecimal string and eval: is this suspicious?

answered Aug 11, 2013 at 10:47

3 votes

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

answered Aug 10, 2013 at 9:29

4 votes

Accessing keystrokes directed at iframe?

answered Aug 8, 2013 at 12:23

4 votes

Accepted

ASP.NET SQL Injection

answered Aug 6, 2013 at 23:05

7 votes

Accepted

How to ensure that files uploaded by users do not contain any XSS code

answered Jul 15, 2013 at 10:37

12 votes

Accepted

How to remove ssh rootkits?

answered Jul 12, 2013 at 9:40

29 votes

Is there a security reason for a site to limit the number of times a user can change their password?

answered Jul 10, 2013 at 7:38

15 votes

Accepted

Specific risks of embedding an HTTPS iframe in an HTTP page

answered Jul 3, 2013 at 8:48

1 vote

Trust among the root-CAs

answered Jun 23, 2013 at 12:44

5 votes

Storing credit card data on behalf of customers: and transfer the data later

answered Jun 22, 2013 at 18:53

14 votes

Accepted

Unknown Asian/Chinese registry keys

answered Jun 13, 2013 at 19:21

2 votes

Is there any good reason not to salt/hash passwords you store?

answered May 31, 2013 at 10:26

21 votes

Accepted

Why does this XSS vector work in svg but not in HTML?

answered May 31, 2013 at 9:37

5 votes

CSRF Token in GET request

answered May 31, 2013 at 9:13

2 votes

File shares from a DMZ into an internal network

answered May 31, 2013 at 8:55

3 votes

Is cookie-based XSS exploitable?

answered May 20, 2013 at 16:57

2 votes

Certificate authentication with jQuery's ajax() function

answered May 15, 2013 at 8:39

0 votes

What are the security risks of pirating video or music?

answered May 9, 2013 at 21:29

17 votes

Is showing your IP address in the URL a bad practice?

answered May 9, 2013 at 21:01

1 vote

Remote File Injection in ARGS blocking form updating database

answered Apr 23, 2013 at 22:21

5 votes

Accepted

Bypassing Web Application input validation

answered Apr 16, 2013 at 21:08

Stack Exchange Network

159 Answers

How about preventing CSRF this way?

What information can be seen from HTTPS to HTTP?

Flash ignores Content-Type header, allowing XSS?

Calling JavaScript functions from within a Style tag XSS

Malware Suddenly Uploaded To My Website!

XSS prevention for RESTful services

Is the Web browser status bar always trustable?

Need help deciphering malicious JS code

What are the security implications of the POLi Internet Payments technique?

Javascript containing a long hexadecimal string and eval: is this suspicious?

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

Accessing keystrokes directed at iframe?

ASP.NET SQL Injection

How to ensure that files uploaded by users do not contain any XSS code

How to remove ssh rootkits?

Is there a security reason for a site to limit the number of times a user can change their password?

Specific risks of embedding an HTTPS iframe in an HTTP page

Trust among the root-CAs

Storing credit card data on behalf of customers: and transfer the data later

Unknown Asian/Chinese registry keys

Is there any good reason not to salt/hash passwords you store?

Why does this XSS vector work in svg but not in HTML?

CSRF Token in GET request

File shares from a DMZ into an internal network

Is cookie-based XSS exploitable?

Certificate authentication with jQuery's ajax() function

What are the security risks of pirating video or music?

Is showing your IP address in the URL a bad practice?

Remote File Injection in ARGS blocking form updating database

Bypassing Web Application input validation