Monthly Archives: November 2014

Cross-site scripting in millions of web sites

Posted on 18-11-2014 by Sijmen Ruwhof

In August 2014 I found a severe cross-site scripting security vulnerability in the latest version (1.13.0) of the ‘jQuery Validation Plugin‘ during a security penetration test for a customer. This jQuery plugin which adds easy form validation functionality to a web site, is … Continue reading →

Posted in cross site scripting, Google, PHP, responsible disclosure | 62 Comments

2.364 Nederlandse bedrijfswebsites met ernstige beveiligingslekken

Posted on 08-11-2014 by Sijmen Ruwhof

Toen ik in oktober 2012 op internet op zoek was naar een nieuwe auto, kwam ik een autobedrijf tegen waar ik een auto wou gaan kopen: (bovenstaande website is van een willekeurig bedrijf uit de lijst die ik later beschrijf) … Continue reading →

Posted in responsible disclosure, search engine optimization, security vulnerability, website security | 15 Comments

Password hash disclosure in Linksys Smart WiFi routers

Posted on 01-11-2014 by Sijmen Ruwhof

This is my tale about reporting a specific security vulnerability in a major product, just to give some insight in how responsible disclosures are handled by a security researcher (me) and various software companies (Cisco, Linksys and Belkin). On May … Continue reading →

Posted in password, responsible disclosure | 5 Comments