full-disclosure - Re: Knorr.de SQL Injection and XSS Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 02 Mar 2007 15:46:22 +0100
From: Sebastian Bauer <sbauer@...-network.net>
To: Knud Erik Højgaard <kokanin@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Knorr.de SQL Injection and XSS	Vulnerabilities

The point why I rated those problems as high risk was that due to this  
problems free access to all user data was possible.

And problems that will offer any kind of user data (including  
unencrypted passwords) is a significant security risk from my point of  
view (see the latest problems regarding StudiVZ).

A lot of people are using the same password for websites, email and so  
on. And getting a password using this security hole makes it also  
possible to log in to a lot of email accounts that don't belong to you.

-- 

==============================
Sebastian Bauer
http://blog.gjl-network.net

Zitat von Knud Erik Højgaard <kokanin@...il.com>:

> On 3/2/07, sbauer@...-network.net <sbauer@...-network.net> wrote:
>
>> Significance: Very Critical
>
> For who, the sauce-people? Not for me.
>
>> All problems found have been discussed with Unilever, the mother
>> company of Knorr and
>> have been fixed before the release of this document.
>
> Sooo, why should anyone besides you and the sauce-people care?
>
> --
> kokanin

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/