CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability
Product: PingFederate 6.10.1 SP Endpoints
Vendor: Ping Identity Corporation
Vulnerable Versions: 6.10.1
Tested Version: 6.10.1
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8489
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]








http://article.gmane.org/gmane.comp.security.fulldisclosure/1302/match=

Google’s DoubleClick Advertising Platform Vulnerable to Open Redirect Attacks

Google’s DoubleClick Advertising Platform Vulnerable to Open Redirect Attacks


Although Google does not include Open Redirect vulnerabilities in its bug bounty program, its preventive measures against Open Redirect attackshave been quite thorough and effective to date.


However, Google DoubleClick.net advertising system is vulnerable to Open Redirect Attacks. The vulnerability was found by a security researcher Wang Jing from School of Physical and Mathematical Science, Nanyang Technology University, Singapore.


These redirections can be easily used by spammers, too.


Moreover, these vulnerabilities can be used to attack other companies such as Google, eBay, The New York Times, e.g. by bypassing their Open Redirect filters(Covert Redirect).




http://www.hotforsecurity.com/blog/googles-doubleclick-advertising-platform-vulnerable-to-open-redirect-attacks-10822.html

The Weather Channel Fixes Web App Flaws

The Weather Channel Fixes Web App Flaws




The Weather Channel has fixed a common web application security problem on its website that made nearly all links vulnerable to cross-site scripting attacks.



Wang Jing, a doctoral student at the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore, found more than 75 percent of the Web pages on Weather.com were vulnerable.



"Attackers just need to add script at the end of The Weather Channel's URLs," Wang wrote. "Then the scripts will be executed."




http://www.computerworld.com/article/2852502/weathercom-fixes-web-app-flaws.html