Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Great, you use CA SiteMinder, but you broke it!

netspi.com | blog | #sql-injection | #xss | #sso | #misconfiguration | #ca-siteminder | #web-access-management

Summary

CA SiteMinder blocks SQL injection and XSS out of the box, but tweaking it to pass full SQL statements from browsers reintroduces those flaws, and its own standard pages can become XSS vectors.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Open Source Frameworks – How secure are they?
Open source doesn't mean secure: reviewing one company's untouched framework surfaced nearly 80% of 10,000+ findings, including SQL injection and persistent XSS—vet third-party code accordingly.
blog · netspi.com
What's Happening in the Application Security Arena?
According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.
blog · github.com
HowToHunt: Practical Methodologies and Test Cases for Web Vulnerability Hunting
Consolidates battle-tested bug bounty hunting checklists and methodologies into structured, actionable guides for security researchers and penetration testers.
blog · netspi.com
Stay Ahead of Cloud Threats: Introducing Azure and AWS Security Reviews
Discover how NetSPI's Azure & AWS Configuration Reviews provide continuous visibility, risk identification, and actionable insights to secure your cloud environments.
blog · netspi.com
From Informational to Critical: Chaining & Elevating Web Vulnerabilities
Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest.
blog · netspi.com
Prototype Pollution: A Deep-Dive
A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.
back