Weather.com fixes web application vulnerabilities

  • 28 November 2014
  • 0 replies
  • 510 views

Userlevel 7
Badge +54
Jeremy Kirk  Nov 27, 2014 
 
The Weather Channel has fixed a common web application security problem on its website that made nearly all links vulnerable to cross-site scripting attacks.
 
Wang Jin, a doctoral student at the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore, found more than 75 percent of the webpages on Weather.com were vulnerable.
 
“Attackers just need to add script at the end of The Weather Channel’s URLs,” Wang wrote. “Then the scripts will be executed.”
 
Wang posted his findings on the Full Disclosure forum, writing that the issues have been fixed. He wrote that he tested tens of thousands of links on Weather.com using a custom tool and posted a video illustrating an attack.
 
Full Article
 

0 replies

Be the first to reply!

Reply