OWASP JSEC CVE DETAILS

8
OWASP JSEC CVE DETAILS Dibyendu Sikdar (@dibsyhex) OSWAP Kolkata Chapter , Sillycon

description

OWASP JSEC CVE DETAILS. Dibyendu Sikdar (@ dibsyhex ) OSWAP Kolkata Chapter , Sillycon. >> whoami. Dibyendu Sikdar OpenSource Developer & Security Researcher Project Leader of OWASP JSEC DETAILS Acknowledged and listed in various Hall of Fame - AT&T , Microsoft, Oracle ,Adobe , etc. - PowerPoint PPT Presentation

Transcript of OWASP JSEC CVE DETAILS

Page 1: OWASP JSEC CVE DETAILS

OWASP JSEC CVE DETAILS

Dibyendu Sikdar (@dibsyhex)OSWAP Kolkata Chapter , Sillycon

Page 2: OWASP JSEC CVE DETAILS

>>whoami

• Dibyendu Sikdar • OpenSource Developer & Security Researcher• Project Leader of OWASP JSEC DETAILS• Acknowledged and listed in various Hall of

Fame - AT&T , Microsoft, Oracle ,Adobe ,etc

Page 3: OWASP JSEC CVE DETAILS

What is CVE ?

• CVE or The Common Vulnerabilities and Exposures system provides a reference method for publicly known information security vulnerabilities and exposures

Page 4: OWASP JSEC CVE DETAILS

Example

•  CVE-2014-5250• Details - Unspecified vulnerability in the AJAX

autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors.

Page 5: OWASP JSEC CVE DETAILS

So what makes this tool cool?

• This desktop application can be used to fetch the latest CVEs directly from the CVE details online service cvedetails.com.

• Search CVEs• Search Exploits• Search POCs• Search Vulnerabilities

Page 6: OWASP JSEC CVE DETAILS

Screenshot

Page 7: OWASP JSEC CVE DETAILS

Project Timeline• 13 June 2014 - Released the project as open

source• 17 August 2014 - Requested for OWASP

project approval• 20 August 2014 - Project Proposal Accepted• 21 August 2014 - To be released under

OWASP Kolkata Chapter ,SillyCon• 22 September 2014 - V2.0 Released

Page 8: OWASP JSEC CVE DETAILS

Future Plans

• Android Version• Improved UI


SECURITY - KIPPEO® TECHNOLOGIES · 2019. 10. 18. · OWASP Top10, CVE and the new 0-day exploits. 0˚DAY EXPLOITS DETECTION HTTPCS guarantees zero-false-positive audit reports, as

SECURITY - KIPPEO® TECHNOLOGIES · 2019. 10. 18. · OWASP Top10, CVE and the new 0-day exploits. 0˚DAY EXPLOITS DETECTION HTTPCS guarantees zero-false-positive audit reports, as

JNCIS Security Certification Boot Camp (JSEC, JUTM) · 2017. 5. 18. · JSEC-JUTM info@globalknowledge.co.uk 01189 123456 JNCIS Security Certification Boot Camp (JSEC, JUTM) Duration:

JNCIS Security Certification Boot Camp (JSEC, JUTM) · 2017. 5. 18. · JSEC-JUTM [email protected] 01189 123456 JNCIS Security Certification Boot Camp (JSEC, JUTM) Duration:

THE RANSOMWARE - Microsoft...CVE-2012-1054, CVE-2015-0204, CVE-2015-1637, CVE-2003-0818, CVE-2002-0126, CVE-1999-1058 Start out by patching those and you can drastically reduce your

THE RANSOMWARE - Microsoft...CVE-2012-1054, CVE-2015-0204, CVE-2015-1637, CVE-2003-0818, CVE-2002-0126, CVE-1999-1058 Start out by patching those and you can drastically reduce your

Technical Data - jsec-tw.come).pdf · Technical Data. 2 Product Overview PowerFlex ...

Technical Data - jsec-tw.come).pdf · Technical Data. 2 Product Overview PowerFlex ...

CVE Training Manual

CVE Training Manual

Common Vulnerabilities and Exposures (CVE) Numbering ...cve.mitre.org/cve/cna/CNA_Rules_v2.0.pdf · Common Vulnerabilities and Exposures (CVE) Numbering ... The Common Vulnerabilities

Common Vulnerabilities and Exposures (CVE) Numbering ...cve.mitre.org/cve/cna/CNA_Rules_v2.0.pdf · Common Vulnerabilities and Exposures (CVE) Numbering ... The Common Vulnerabilities

CVE 325 Final

CVE 325 Final

The code behind the vulnerability - OWASP Foundation€¦ · XSS in ASP.NET Core with Raw HTML (CVE-2018-0784) Griefingvia CSRF (CVE-2018-0785) Malware via WSDL (CVE-2017-8759) Hash

The code behind the vulnerability - OWASP Foundation€¦ · XSS in ASP.NET Core with Raw HTML (CVE-2018-0784) Griefingvia CSRF (CVE-2018-0785) Malware via WSDL (CVE-2017-8759) Hash

CVE 4073/5073

CVE 4073/5073

Cve trends 20170531

Cve trends 20170531

JSEC Participants GA 2014-2015

JSEC Participants GA 2014-2015

JSEC presentation

JSEC presentation

Abusing JSONP with - OWASP › › 20150218-Abusing_JSONP...2015/02/18  · Abusing JSONP with Michele Spagnuolo @mikispag - CVE-2014-4671, CVE-2014-5333 Pwnie Awards 2014 Nominated

Abusing JSONP with - OWASP › › 20150218-Abusing_JSONP...2015/02/18  · Abusing JSONP with Michele Spagnuolo @mikispag - CVE-2014-4671, CVE-2014-5333 Pwnie Awards 2014 Nominated

OWASP – Top 10 · • OWASP Code Review Guide • OWASP Testing Guide • OWASP Top Ten Project . OWASP – TOP 10 • OWASP Top 10 Web Application Security Risks for 2010 are:

OWASP – Top 10 · • OWASP Code Review Guide • OWASP Testing Guide • OWASP Top Ten Project . OWASP – TOP 10 • OWASP Top 10 Web Application Security Risks for 2010 are:

Apache Struts Understanding how Apache Struts ... attack that resulted in a mega data breach. ... CVE-2011-1772 CVE-2016-3082 CVE-2016-0785 CVE-2013-4316 CVE-2012-0838 CVE …

Apache Struts Understanding how Apache Struts ... attack that resulted in a mega data breach. ... CVE-2011-1772 CVE-2016-3082 CVE-2016-0785 CVE-2013-4316 CVE-2012-0838 CVE …

cve xpJ08kIn90 Verificaciónnoticias.clubmarusia.com/.../2019/05/ESTATUTOS-MARUSIA.pdf · 2019. 5. 17. · CVE: xpJ08kIn90 Verificación: . CVE: xpJ08kIn90 Verificación: . CVE: xpJ08kIn90

cve xpJ08kIn90 Verificaciónnoticias.clubmarusia.com/.../2019/05/ESTATUTOS-MARUSIA.pdf · 2019. 5. 17. · CVE: xpJ08kIn90 Verificación: . CVE: xpJ08kIn90 Verificación: . CVE: xpJ08kIn90

Cve presentation slide

Cve presentation slide

From CVE-2010-0738 to the recent JBoss worm - OWASP · JBoss at first glance ⌘ JBoss Application Server is an OpenSource Java Enterprise Edition Application Server ⌘ It’s in

From CVE-2010-0738 to the recent JBoss worm - OWASP · JBoss at first glance ⌘ JBoss Application Server is an OpenSource Java Enterprise Edition Application Server ⌘ It’s in

OWASP The OWASP Foundation

OWASP The OWASP Foundation

API design for cryptography - Hack.luarchive.hack.lu/2017/hacklu-crypto-api.pdf · Focused on high-speed cryptography ... CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080

API design for cryptography - Hack.luarchive.hack.lu/2017/hacklu-crypto-api.pdf · Focused on high-speed cryptography ... CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080