<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>MaverickBlogging</title>
	<atom:link href="http://maverickblogging.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://maverickblogging.com</link>
	<description>technology &#38; art byG. S. McNamara</description>
	<lastBuildDate>Sat, 11 Oct 2014 02:05:51 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9</generator>
	<item>
		<title>Can&#8217;t Even Order a Pizza Safely</title>
		<link>http://maverickblogging.com/cant-even-order-a-pizza-safely/</link>
					<comments>http://maverickblogging.com/cant-even-order-a-pizza-safely/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Sat, 11 Oct 2014 02:04:20 +0000</pubDate>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[AppSec]]></category>
		<category><![CDATA[cookie security]]></category>
		<category><![CDATA[cookie validation]]></category>
		<category><![CDATA[data validation]]></category>
		<category><![CDATA[input validation]]></category>
		<category><![CDATA[owasp]]></category>
		<category><![CDATA[papa johns]]></category>
		<category><![CDATA[pizza]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[unhandled exception]]></category>
		<category><![CDATA[webappsec]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=1018</guid>

					<description><![CDATA[Validate input from all sources! What caught my eye was address information that is not pulled from a backend database: Values are stored in the &#8220;pjCustomer&#8221; cookie, not encrypted, right there for you (or another device user) to read: The server does not handle tampered input well&#8211;specifically opening and closing script tags: Maybe data stored in this cookie is [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/cant-even-order-a-pizza-safely/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Disclosed (Patched): AddThis Email Sharing Button API XSS and Iframe Injection</title>
		<link>http://maverickblogging.com/disclosed-patched-addthis-email-sharing-button-api-xss-and-iframe-injection/</link>
					<comments>http://maverickblogging.com/disclosed-patched-addthis-email-sharing-button-api-xss-and-iframe-injection/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Wed, 08 Oct 2014 03:34:47 +0000</pubDate>
				<category><![CDATA[Announcements]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[AddThis]]></category>
		<category><![CDATA[AppSec]]></category>
		<category><![CDATA[Client-Server]]></category>
		<category><![CDATA[Iframe Injection]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Social Media Sharing]]></category>
		<category><![CDATA[Web Service]]></category>
		<category><![CDATA[XSS]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=994</guid>

					<description><![CDATA[AddThis had XSS and Iframe vulnerabilities ]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/disclosed-patched-addthis-email-sharing-button-api-xss-and-iframe-injection/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Disclosing CVE-2014-4958: Stored Attribute-Based Cross-Site Scripting (XSS) Vulnerability in Telerik UI for ASP.NET AJAX RadEditor Control</title>
		<link>http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control/</link>
					<comments>http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control/#comments</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Thu, 25 Sep 2014 03:57:15 +0000</pubDate>
				<category><![CDATA[Announcements]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[cross-site scripting]]></category>
		<category><![CDATA[cve]]></category>
		<category><![CDATA[vulnerability disclosure]]></category>
		<category><![CDATA[web application security]]></category>
		<category><![CDATA[web appsec]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=964</guid>

					<description><![CDATA[All versions of the popular UI for ASP.NET AJAX RadEditor Control product by Telerik may be affected by a high-risk stored attribute-based cross-site scripting (XSS) vulnerability that is assigned CVE-2014-4958 by MITRE, NVD, by OSVDB as ID 112083, and covered in the news. This WYSIWYG rich text editor is “&#8230;what Microsoft chose to use in MSDN, CodePlex, TechNet, MCMS and even as [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control/feed/</wfw:commentRss>
			<slash:comments>4</slash:comments>
		
		
			</item>
		<item>
		<title>Disclosed: XSS Vulnerability in IBM WebSphere Application Server Integrated Solutions Console</title>
		<link>http://maverickblogging.com/disclosed-xss-vulnerability-in-ibm-websphere-application-server-integrated-solutions-console/</link>
					<comments>http://maverickblogging.com/disclosed-xss-vulnerability-in-ibm-websphere-application-server-integrated-solutions-console/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Fri, 05 Sep 2014 04:07:16 +0000</pubDate>
				<category><![CDATA[Announcements]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[cross-site scripting]]></category>
		<category><![CDATA[IBM]]></category>
		<category><![CDATA[Integrated Solutions Console]]></category>
		<category><![CDATA[reflected XSS]]></category>
		<category><![CDATA[vulnerability disclosure]]></category>
		<category><![CDATA[web application security]]></category>
		<category><![CDATA[WebSphere]]></category>
		<category><![CDATA[XSS]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=954</guid>

					<description><![CDATA[Reflected Cross-Site Scripting (XSS) Vulnerability Disclosure in IBM WebSphere Application Server Integrated Solutions Console]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/disclosed-xss-vulnerability-in-ibm-websphere-application-server-integrated-solutions-console/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Adding Open Source Framework Hardening to your SDLC: A Podcast with Jeremiah Grossman, iCEO of WhiteHat Security</title>
		<link>http://maverickblogging.com/adding-open-source-framework-hardening-to-your-sdlc-a-podcast-with-jeremiah-grossman-iceo-of-whitehat-security/</link>
					<comments>http://maverickblogging.com/adding-open-source-framework-hardening-to-your-sdlc-a-podcast-with-jeremiah-grossman-iceo-of-whitehat-security/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Tue, 11 Mar 2014 16:12:42 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Web]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=945</guid>

					<description><![CDATA[I spoke with Jeremiah Grossman, the Founder and interim CEO of WhiteHat Security, about Ruby on Rails, Django, and the need to add additional time to your estimates for adapting these and other Web frameworks to your environment when developing custom Web applications. Listen here: https://blog.whitehatsec.com/adding-open-source-framework-hardening-to-your-sdlc-podcast/]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/adding-open-source-framework-hardening-to-your-sdlc-a-podcast-with-jeremiah-grossman-iceo-of-whitehat-security/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>CWE-613: Insufficient Session Expiration (Supplement)</title>
		<link>http://maverickblogging.com/cwe-613-insufficient-session-expiration-supplement/</link>
					<comments>http://maverickblogging.com/cwe-613-insufficient-session-expiration-supplement/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Mon, 10 Feb 2014 21:30:11 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[CWE Supplement]]></category>
		<category><![CDATA[CWE-613]]></category>
		<category><![CDATA[insufficient session expiration]]></category>
		<category><![CDATA[MITRE CWE]]></category>
		<category><![CDATA[session management security]]></category>
		<category><![CDATA[session termination]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=933</guid>

					<description><![CDATA[This is supplemental information to CWE-613: Insufficient Session Expiration. Under Common Consequences: Scope: Access Control Effect: Technical Impact: Permanent session hijacking Under Demonstrative Examples: Example 2: The following example is similar to how Ruby on Rails’ CookieStore session storage mechanism works. The entire session object is sent to the Web browser, not just a session [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/cwe-613-insufficient-session-expiration-supplement/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>You Can&#8217;t Log Out of Pinterest or Instagram &#8211; Django Web Framework Security Weakness</title>
		<link>http://maverickblogging.com/you-cant-log-out-of-pinterest-or-instagram-django-web-framework-security-weakness/</link>
					<comments>http://maverickblogging.com/you-cant-log-out-of-pinterest-or-instagram-django-web-framework-security-weakness/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Thu, 26 Dec 2013 19:32:16 +0000</pubDate>
				<category><![CDATA[Announcements]]></category>
		<category><![CDATA[Do-it-yourself DIY]]></category>
		<category><![CDATA[Education]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[client side session storage]]></category>
		<category><![CDATA[cookie-based session storage]]></category>
		<category><![CDATA[Django cookie-based session storage]]></category>
		<category><![CDATA[django security]]></category>
		<category><![CDATA[Django session security]]></category>
		<category><![CDATA[django session storage]]></category>
		<category><![CDATA[django web framework security]]></category>
		<category><![CDATA[instagram]]></category>
		<category><![CDATA[Instagram security]]></category>
		<category><![CDATA[pinterest]]></category>
		<category><![CDATA[Pinterest security]]></category>
		<category><![CDATA[web app pentesting]]></category>
		<category><![CDATA[web app sec]]></category>
		<category><![CDATA[web application frameworks]]></category>
		<category><![CDATA[web application security]]></category>
		<category><![CDATA[website security]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=923</guid>

					<description><![CDATA[The Django Web application framework made to help you build websites fast offers a session storage mechanism that does not allow a visitor to fully terminate their session when they log out. Though not the default storage mechanism &#8212; as is the case with Ruby on Rails &#8212; it is an option. I found that [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/you-cant-log-out-of-pinterest-or-instagram-django-web-framework-security-weakness/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>The Following Information Security Counter Arguments are Invalid</title>
		<link>http://maverickblogging.com/the-following-information-security-counter-arguments-are-invalid/</link>
					<comments>http://maverickblogging.com/the-following-information-security-counter-arguments-are-invalid/#respond</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Tue, 26 Nov 2013 21:11:18 +0000</pubDate>
				<category><![CDATA[Advice]]></category>
		<category><![CDATA[Education]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[information security counterarguments]]></category>
		<category><![CDATA[security reluctance]]></category>
		<category><![CDATA[security resistance]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=889</guid>

					<description><![CDATA[After bringing attention to the inability to terminate a session in some popular open source web application frameworks, many of the counterarguments fell into the following bins: We already knew about this Why is it still an issue? Too few people know about it; other developers, even users need to be informed and heard from. [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/the-following-information-security-counter-arguments-are-invalid/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>How to Verify the Rails CookieStore Session Termination Weakness</title>
		<link>http://maverickblogging.com/how-to-verify-the-rails-cookiestore-session-termination-weakness/</link>
					<comments>http://maverickblogging.com/how-to-verify-the-rails-cookiestore-session-termination-weakness/#comments</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Sun, 24 Nov 2013 17:40:47 +0000</pubDate>
				<category><![CDATA[Do-it-yourself DIY]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[DIY security]]></category>
		<category><![CDATA[Kickstarter security]]></category>
		<category><![CDATA[Rails CookieStore]]></category>
		<category><![CDATA[Ruby on Rails security]]></category>
		<category><![CDATA[Session Termination Weakness]]></category>
		<category><![CDATA[web application security tutorial]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=849</guid>

					<description><![CDATA[I want to try it out myself you say. Here is a video explanation using Kickstarter.com as an example: &#160; And here are the steps you take to verify the weakness yourself&#8211;using Kickstarter.com, as well as on other websites you suspect are using Rails&#8217; CookieStore (such as those on this list): Install a Chrome plugin such as [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/how-to-verify-the-rails-cookiestore-session-termination-weakness/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
			</item>
		<item>
		<title>List of websites using Ruby on Rails&#8217; CookieStore for session management</title>
		<link>http://maverickblogging.com/list-of-websites-using-ruby-on-rails-cookiestore-for-session-management/</link>
					<comments>http://maverickblogging.com/list-of-websites-using-ruby-on-rails-cookiestore-for-session-management/#comments</comments>
		
		<dc:creator><![CDATA[G. S. McNamara]]></dc:creator>
		<pubDate>Thu, 21 Nov 2013 02:02:33 +0000</pubDate>
				<category><![CDATA[Do-it-yourself DIY]]></category>
		<category><![CDATA[Education]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Web]]></category>
		<category><![CDATA[client side session storage]]></category>
		<category><![CDATA[cookie-based session storage]]></category>
		<category><![CDATA[django security]]></category>
		<category><![CDATA[django session storage]]></category>
		<category><![CDATA[Ruby on Rails security]]></category>
		<category><![CDATA[web app security]]></category>
		<category><![CDATA[web security]]></category>
		<guid isPermaLink="false">http://maverickblogging.com/?p=830</guid>

					<description><![CDATA[When bringing attention to the session termination security issue present with Ruby on Rails&#8217; CookieStore and Django&#8217;s cookie-based session storage mechanism, one of the common questions I get is &#8220;Who is using it?&#8221; Well, I did some digging and have the following list of 1,897 websites for your review. These are Rails sites only (before version 4.0, [&#8230;]]]></description>
		
					<wfw:commentRss>http://maverickblogging.com/list-of-websites-using-ruby-on-rails-cookiestore-for-session-management/feed/</wfw:commentRss>
			<slash:comments>11</slash:comments>
		
		
			</item>
	</channel>
</rss>
