FortConsult offentliggør løbende nogle af de sårbarheder, som vi selv finder i kraft af vores arbejde med sårbarheder. Vores sikkerhedskonsulenter arbejder med sårbarheder hver eneste dag, fx når vi sikkerhedstester, eller når vi vurderer nye sikkerhedstrusler på vegne af vores kunder. Derfor har vi opbygget en unik kernekompetence inden for sårbarheder, som også betyder, at vi løbende opdager nye sårbarheder i eksisterende produkter.   FortConsult advisories skal ikke forveksles med de advisories, som udsendes via early warning services, og som fx kan findes på www.securityfocus.com under BugTraq.   Vores generelle holdning er, at vi først offentliggør en sårbarhed, når vi har underrettet producenten, og vedkommende har fået rettet sikkerhedsbristen og udsendt en patch eller workaround. Der kan imidlertid forekomme tilfælde, hvor det er i vores kunders interesse, at vi informerer dem om problemet tidligere. I så fald vil vi gøre det – og sørge for at producenten ved besked om det.   Du kan se vores seneste advisories og research papers herunder. Er du interesseret i en uddybende forklaring, er du velkommen til at kontakte os. Kunder, der abonnerer på StayAlert™ får automatisk besked, hvis den nyopdagede sårbarhed har betydning for deres it-systemer. På samme måde som de får besked om alle øvrige nye sårbarheder, der bliver kendte.   Oversigt over advisories No. Discovery Date Title Status Advisory Availability 26 February 2009 glFusion CMS-"Comment" Cross-Site scripting Vulnerability Vendor Corrected Advisory Public 25 December 2008 Samhain IDS Denial of Service Vendor Notified Advisory Private 24 December 2008 Barracuda Load Balancer XSS Vendor Corrected Advisory Public 23 November 2008 Microsoft SharePoint Website Source code revealed Vendor Notified Advisory Private 22 November 2008 Beltane Cross-site scripting Vendor Notified Advisory Private 21 November 2008 Firebird - Default settings allow file system enumeration Vendor Notified Advisory Private 20 November 2008 FotoWeb Multiple XSS Vulnerabilities Vendor Notified Advisory Public 19 November 2008 SiteCore "Page not Found" XSS Vulnerability Vendor Corrected Advisory Public 18 June 2008 Direct Web Remoting - Cross-Site Scripting on Error Page Vendor Notified Advisory Public 17 November 2007 PunBB imgUpload extention Vendor Notified Advisory Public 16 June 2007 DotNetNuke Cross-Site Redirection Vendor Corrected Advisory Public 15 June 2007 ISPmgr local root Vendor Notified Advisory Public 14 June 2007 DotNetNuke 4.4.0. admin login bypass Vendor Corrected Advisory Public 13 May 2007 IDIS NVR format string DoS and code-exec Vendor Notified Advisory Private 12 December 2006 Citrix Session - Reliability OpenProxy Vendor Corrected Advisory Public 11 March 2007 Music700 router / VoIP remote command exec Vendor Notified Advisory Public 10 February 2007 eWire PHP component remote code execution Vendor Notified Advisory Public 9 January 2007 Steema SL "TeeCharts ActiveX" data proxy Vendor Notified Advisory Public (See Proof of Concept) 8 September 2006 Citrix Unspecified Heap & Stack Vulns Vendor Corrected Advisory Public 7 May 2006 Lotus Notes Pre-login Information Leakage Vendor Corrected Advisory Public 6 April 2006 Lotus SameTime Sandbox Escape Vendor Corrected Advisory Public 5 March 2006 Cisco VPN Privilege Escalation Vendor Corrected Advisory Public 4 March 2006 Lotus Domino tunekrnl priv esc via heap Vendor Corrected Advisory Public 3 March 2006 Lotus Domino tunekrnl priv esc via stack Vendor Corrected Advisory Public 2 March 2006 Cryptomathic Primink_CSP ActiveX Exploit (research assistance to CIRT.DK) Vendor Corrected Advisory Public 1 October 2005 Paros Proxy Default "sa" password Remote Command Exec / Data Disclosure Vendor Corrected Advisory Public Research Papers No. Publication Date Title Availability 4 February 2009 Wireless at the hospital and the threats they face PDF Paper Available 3 June 2008 Site Wide XSS PDF Paper Available 2 October 2006 Tor: Practical Onion Hacking PDF Paper Available 1 March 2006 Tor: Peeling the Onion PDF Paper Available Proof of Concept No. Publication Date Title Availability A12 December 2006 Citrix Session - Reliability OpenProxy Demo A9 January 2007 Steema SL "TeeCharts ActiveX" data proxy Demo 1 Demo 2 R1 October 2006 Tor: Practical Onion Hacking - packet injection tools Tools mentioned in PDF Paper Available Tilbage >