This boils down mostly to a lot of sites running jQuery at a version less than 3.0.0.
Which technically means "vulnerabilities", but depends on how it's used.
Looking at how many sites use vulnerable JavaScript libraries
31–40 of 53 posts
Re: Looking at how many sites use vulnerable JavaScript libraries
#32Re: Looking at how many sites use vulnerable JavaScript libraries
#33If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...
I absolutely hate these kinds of "security" scans. I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high. I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "ma…
There was a fund raising website written 15 years ago that a team I was on was responsible for (I never actually worked on it).
There were fraudulent credit card donations for $1 which became really obvious when the zip code was garbage.
The “solution” was to disabled the credit card page until the month of the fund raising event when it was enabled again in hopes of the scammers would not try during that month.
Re: Looking at how many sites use vulnerable JavaScript libraries
#34Snyke posted “The State of Open Source Security” not long ago
Re: Looking at how many sites use vulnerable JavaScript libraries
#35> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.
Vulnerabilities don't have to affect the backend - most of JQuery-related CVEs that I could find had to do with XSS.
which can only happen if you pass wrong data from the backend to the jquery related function. I.e. dynamically generate input for $()...
Re: Looking at how many sites use vulnerable JavaScript libraries
#36Earlier quoted context omitted.
Vulnerabilities don't have to affect the backend - most of JQuery-related CVEs that I could find had to do with XSS.
which can only happen if you pass wrong data from the backend to the jquery related function. I.e. dynamically generate input for $()...
Well not really backend exclusive: `$('#foo').append('Showing search results for ' + (new URL(location)).searchParams.search);`
Re: Looking at how many sites use vulnerable JavaScript libraries
#37If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...
I absolutely hate these kinds of "security" scans. I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high. I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "ma…
As annoying as that sort of ignorance is, I would say it's marginally better than the opposite attitude that security scanners are bullshit and therefore unnecessary. The fact is, scanners turn up real issues that slip through whatever manual patching process you have set up.
My feeling is similar to when I started unit testing aggressively a decade ago: it seems like this should be unnecessary, but every time I do it it never fails to pay dividends.
Re: Looking at how many sites use vulnerable JavaScript libraries
#38Earlier quoted context omitted.
I absolutely hate these kinds of "security" scans. I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high. I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "ma…
There was a fund raising website written 15 years ago that a team I was on was responsible for (I never actually worked on it). There were fraudulent credit card donations for $1 which became really obvious when the zip code was garbage. The “solution” was to disabled the credit card page until the month of the fund raising event when it was enabled again in hopes of the scammers would not try during that month.
I don't understand, what were the scammers trying to achieve?
Re: Looking at how many sites use vulnerable JavaScript libraries
#39Earlier quoted context omitted.
There was a fund raising website written 15 years ago that a team I was on was responsible for (I never actually worked on it). There were fraudulent credit card donations for $1 which became really obvious when the zip code was garbage. The “solution” was to disabled the credit card page until the month of the fund raising event when it was enabled again in hopes of the scammers would not try during that month.
I don't understand, what were the scammers trying to achieve?
Maybe hoping there was an affirmative response if the card did go through?
Re: Looking at how many sites use vulnerable JavaScript libraries
#40Earlier quoted context omitted.
There was a fund raising website written 15 years ago that a team I was on was responsible for (I never actually worked on it). There were fraudulent credit card donations for $1 which became really obvious when the zip code was garbage. The “solution” was to disabled the credit card page until the month of the fund raising event when it was enabled again in hopes of the scammers would not try during that month.
I don't understand, what were the scammers trying to achieve?
Trying to validate stolen or generated credit card numbers.