Monthly Archives: November 2014

Cross-site scripting in millions of web sites

Posted on November 18, 2014 by Sijmen Ruwhof

In August 2014 I found a severe cross-site scripting security vulnerability in the latest version (1.13.0) of the ‘jQuery Validation Plugin‘ during a security penetration test for a customer. This jQuery plugin which adds easy form validation functionality to a web site, is … Continue reading →

Posted in cross site scripting, Google, PHP, responsible disclosure | 62 Comments

2.364 Nederlandse bedrijfswebsites met ernstige beveiligingslekken

Posted on November 8, 2014 by Sijmen Ruwhof

Toen ik in oktober 2012 op internet op zoek was naar een nieuwe auto, kwam ik een autobedrijf tegen waar ik een auto wou gaan kopen: (bovenstaande website is van een willekeurig bedrijf uit de lijst die ik later beschrijf) … Continue reading →

Posted in responsible disclosure, search engine optimization, security vulnerability, website security | 15 Comments

Password hash disclosure in Linksys Smart WiFi routers

Posted on November 1, 2014 by Sijmen Ruwhof

This is my tale about reporting a specific security vulnerability in a major product, just to give some insight in how responsible disclosures are handled by a security researcher (me) and various software companies (Cisco, Linksys and Belkin). On May … Continue reading →

Posted in password, responsible disclosure | 5 Comments