On HTML Insecurities…
From Comet
Way back when, the first webserver was created, serving HTML documents.
HTML was designed to show documents with hypertext links, and also to allow the documents to have semantic markup that would be displayed to the reader.
HTML version 1 included a HEAD and BODY section. The HEAD section contains information about the document, such as the TITLE. The BODY section contained the text, markup for the text (e.g. H1 headers, LI lists, STRONG emphasis), hyperlinks to other documents, and embedded images.
Web pages were perceived by the web browser as static entities; no scripting or even direct inclusions of other HTML documents (i.e. no EMBED or FRAMES). Such documents posed little security threat, as they did not contain interpreted code or third-party documents (apart from images).
Although it is straightforward to use secure coding practices to ensure that the browser will not be vulnerable to being exploited from viewing a web page, there have been a number of vulnerabilities that have continued to affect even modern browsers, in the area of image display…
Continued: https://www.infosecisland.com/blogview/3303-HTML-insecurities.html
All content from Information-Security-Resources.com will begin migrating to the Infosec Island Network:
We are pleased to announce that Infosec Island™ has acquired www.information-security-resources.com, one of the leading online news portals addressing security issues.
The two infosec communities will continue to be operated separately while ISR’s content is gradually migrated to the Infosec Island framework by mid-year.
Don’t miss out on your opportunity to win one of over $10k in service prizes in the Infosec Island Q1 Membership Drive!
Only completed profiles are automatically entered into the drawing. Registration is quick - it takes less than five minutes to complete.
Prizes include:
• The Grand Prize is a FREE core server license, including maintenance, of the Grid Data Security’s Enhanced Authentication Solution from SyferLock™. This prize has a value of up to $10,000.
• Second Prize – The member winning second prize will receive two myKryptofon security software products from I.D. Rank Security, valued at $690.
• Third Prize – Two third prize winners will receive an EncryptStick™ software application download from Onix International Inc.
Register now and win! https://www.infosecisland.com/
We are also seeking active security bloggers and forum moderators - a great way to increase your exposure and generate more business opportunities for your company.
Contact Anthony through your Island email account, or directly at afreed@WireHeadSecurity.com for more details!
Infosec Island is committed to serving the needs of SMBs and mid-market enterprises across many industries, as well as nonprofits, government agencies and educational organizations and the infosec community at large.
Copyright © 2009 - 2010 WireHead Security, LLC. All rights reserved.
* * *
Stay Informed With ISR News Alerts:
* * *
Follow us on Twitter
Filed under: Cloud computing, D&O Liability, Financial, Government, Infosec Island Network, Insider Threat, Internet Security Alliance, Military, PCI, Sarbanes-Oxley, due diligence, hackers, healthcare, identity-theft, malware, national security, privacy, reach, virtualization
Comments
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
