Sunday, November 23, 2014
Search
  
Submit your own News for
inclusion in our Site.
Click here...
Breaking News
Samsung Files ITC Complaint Against Nvidia
Europe To Ask Google Unlink Its Commercial And Search Services
Streaming TV Service Aereo Files for Bankruptcy
Square Launches Cash Register Service
Call of Duty: Advanced Warfare is the Biggest Entertainment Launch of 2014
Intel-Micron 3D NAND To Have 32 Layers, 256Gb Per Die
Intel To Release Chromecast-like Thumb-sized PCs
Google Contributor Lets You Pay And And See No Ads In Your Favorite Sites
Active Discussions
cdrw trouble
CDR for car Sat Nav
DVD/DL for Optiarc 7191S at 8X
Copied dvd's say blank in computer only
Made video, won't play back easily
New Features In Firefox 33
updated tests for dvd and cd burners
How to generate lots of different CDs quickly
 Home > News > General Computing > Youtube...
Last 7 Days News : SU MO TU WE TH FR SA All News

Monday, July 05, 2010
Youtube Hit By Code Injection Attack


YouTube was hit by a persistent cross-site scripting (XSS) vulnerability which affects YouTube's comment field.

Malicious JavaScript was inserted into user's comments by exploiting a XSS flaw. The bug was abused by unnamed attackers to poison the comments on multiple videos.

Researchers from a Romanian security team (InSecurityRomania) have revealed the vulnerability first.

Google has corrected the issue now but it is possible that malicious users have already exploited it to redirect unwitting YouTube users watching videos to drive-by download pages in order to infect them with malware, adware and spyware.

Cross-site scripting (XSS) vulnerabilities is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

Experts distinguish between at least two primary flavors of XSS: non-persistent and persistent.

The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type. For example, a non-persistent XSS vulnerabilitie in Google could allow malicious sites to attack Google users who visit them while logged in.

The persistent XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. For example, a persistent cross-zone scripting vulnerability coupled with a computer worm allowed execution of arbitrary code and listing of filesystem contents via a QuickTime movie on MySpace.


Previous
Next
Sony Introduces Slim PS3 in Japan        All News        E-books Still Slower Than Reading Print, Study Says
Bluetooth Opens Qualification Program For Bluetooth Version 4.0 Devices     General Computing News      IBM is Moving to Firefox As Its Default Browser

Get RSS feed Easy Print E-Mail this Message

Related News
Youtube Introduces Paid Music Service
Researchers Identify New iOS Vulnerability
RTL To Control YouTube Fashion Platform
YouTube Now Supports 60fps Videos
YouTube To Launch Paid Video Service
YouTube To Fund Hollywood Content Creation: report
Youtube Rates ISP's Video Atreaming Quality
EU May Probe Google Over Youtube's Dominance
Youtube Is Adding 60fps Video Support, Other Features
YouTube to Launch Music Service
YouTube Access to be Restored In Turkey
Youtube Offers ISP Video Performance Reports

Most Popular News
 
Home | News | All News | Reviews | Articles | Guides | Download | Expert Area | Forum | Site Info
Site best viewed at 1024x768+ - CDRINFO.COM 1998-2014 - All rights reserved -
Privacy policy - Contact Us .