Collaborate Disseminate
I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed in another machine it fails with the f… Continue reading Signtool validation fails when signing and validating are done in different machines
I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that.
I have no control over the computer on which my code will… Continue reading Validate Code Signing Root Certificate Offline
ImageMagick does not properly validate user input before processing it using a delegate,which may lead to arbitrary code execution. This issue is also known as"ImageTragick". Continue reading VU#250519: ImageMagick does not properly validate input before processing images using a delegate
An attacker may be able to coerce a user into executing arbitrary code in the context of the current user by attempting to unzip a crafted zip file provided by the attacker. Continue reading VU#862384: libarchive contains a heap-based buffer overflow due to improper input validation
According to OWASP XSS Prevention Cheat Sheet, one should
Strictly validate unsafe attributes such as background, id and name
I understand that background could contain data: urls, and can therefore be exploited even i… Continue reading Why do ID attributes need stricter validation?
I am working on one of my projects where users don’t need to register or login to post an advert, but they have to provide an email address so that a confirmation link can be sent to the provided address for further actions.
I was reading… Continue reading Is Strong email validation really necessary?
I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let’s take a look at this PHP code which uses regular expressions instead of the builtin PH… Continue reading SQL injection using letters and numbers?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to verify the submit reques… Continue reading What are the risk implications of not verifying referer header on login form?
What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and compare, but in this scena… Continue reading Validate hmac with hashed stored key
I’m thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied directly to an element and rem… Continue reading Is it secure to use jQuery on the server-side for user input validation?