Q1 2008 Security Trends Report

Web application security provider, Cenzic, today announced their Q1 Trends Report for 2008.  They analyzed reported information for January 2008 through March 2008 from vulnerability sources such as SecurityFocus, CVE, SANS, USCERT, SecurityTracker, and other third party databases and found these top 10 vulnerabilities listed below.

And if you are too lazy to actually read the report, you can listen to the podcast summary here.

1. MaxDB 'cons.exe' lets remote users execute arbitrary commands on the target system,
2. Sun Java System Identity Manager Input Validation hole permits cross-site scripting attacks,
3. Apache Input Validation Hole in Mod_AutoIndex when the character set is undefined may permit cross-site scripting attacks,
4. QuickTime Movie and PICT File Processing bugs let remote users  execute arbitrary code,
5. Java Runtime environment lets remote applets and applications gain elevated privileges,
6. Windows WebDAV Mini-Redirector Response Handling bug lets remote users execute arbitrary code,
7. Java Web Start Buffer Overflow lets remote users read/write files and execute applications on the target user's system,
8. Adobe ColdFusion Application setEncoding() bug permits cross-site scripting attacks,
9. Asterisk Predictable Session IDs may let remote users hijack HTTP manager sessions, and
10. Rational ClearQuest Input Validation holes permit cross-site scripting attacks.

So read the report today to see a detailed report of all the findings and statistics for the first quarter of 2008.

by
Erin Swanson
ESwanson@cenzic.com