ITS Security

We working here on ITS 6.20 Patch 14 and received a note that the ITS has a vulnerability to Cross Server Scripting (XSS).
Having checked SAPNet notes and other posts regarding this security issue, I've found the following notes who claim to address this issue:
598074, 595383 and 654038
However, all 3 of those seem to deal with other ITS security vulnerabilities.
Does anyone know how input/output validation needs to be altered in order to prevent JS code being executed in HTML templates? Is this an IIS setting?

Hello Michael,
There is a new note, 820916, that is related to cross site scripting. The ITS 6.20 patch 18 now addresses some of the issues with cross site scripting.
Other web server forums also note that Microsoft's URLscan tool for IIS is capable of detecting some cross site scripting, but I have not tested this.
Best regards,
Edgar Chuang

Similar Messages

There is a problem with this connection's security certificate The remote computer cannot be authenticated due to problems with its security certificate. Security certificate problems might indicate an attempt to fool you or intercept any data you send

Hi,
I have this Windows 2008 R2 on which I installed remoteapp some years ago.
Now the certificate expired and I get the message
"There is a problem with this connection's security certificate
The remote computer cannot be authenticated due to problems with its security certificate.
Security certificate problems might indicate an attempt to fool you or intercept any data you send to the remote computer."
How should I renew the certificate? I already went to certification store and tried to renew certificate with same key but then it says "the request contains nor certificate template information".
Please advise.
J.
J.
Jan Hoedt

Does the computer account have Enroll permission to the certificate template?
From the Server running your CA, run mmc, click File then Add/Remove Snap-in...
Add Certificate Templates and click OK.
Find the certificate template, then right click and select properties. On my CA its call ed RemoteDesktopComputers but might be called something different depending on what what template your certificate is based on.
On the security tab, click Oblect types, check Computers then OK. Enter the Computername and click OK. Then give your computer account Enroll permisssion.
HTH,
JB

Word of Caution to Apple: Snow Leopard is one of your best programs ever invented by you. Why are you looking to discontinue it? Both your Maverick and Lion programs failed due to breeches in its security unlike Snow Leopard!

Snow Leopard is one of the best MAC programs ever invented by Apple. So, I wanted to find out why Apple has chosen to discontinue there best working, and greatest, most stable Mac Program they have ever invented. In all honesty, Apple's Lion and Maverick programs have been disastrous due to recent serious security breaches in these new programs, which did not occur with any of Apple's Snow Leopard users like myself. Part of good business is sticking with programs that are enduring and will out last the test of time and technology.
Also, Snow Leopard has proved itself by passing in terms of protecting us "Snow Leopard" users from any security breaches and other problems that have affected both your newer Lion and Maverick programs with all its great technology. Continuing to go in the direction as Apple is going in relation to our Snow Leopard Mac program (by discontinuing this great program as well as support for it) I believe could prove to be a huge and fatal business mistake. Consider enhancing Snow Leopard; in other words continue to build on such positive potential in this way more stable program than your newer ones. Again, please re-consider your decision(s). Any thoughts?
Message was edited by: Dorry40

Apple isn't listening here. (I should point out however, that your premise that Snow has stronger security is not correct. The gotofail error in 10.9 was a one-off and the OSs above 10.6 have greater sandboxing for security.) I still think Snow is a great OS and should receive continued support. It will inevitably become less secure without that.
But this is a user to user forum. Send your comment to feedback.
https://ssl.apple.com/support/feedback/

How can I change payment information if I lost my credit card and its security code so I can keep buy pertinent apps?, How can I change payment information if I lost my credit card and its security code so I can keep buy pertinent apps?

I purchased a macbook pro but couldnt download apps. Facts:
1. I already have an apple ID with my Ipad, which has my old (prepaid) credit card number and security code as payment information
2. I lost my credit card including all info: card number, expiry, security card. I also didnt store it anywhere else and the CC company doesnt have my security code either because it's a prepaid/loadable card (not a real credit card).
3. I purchased a Macbook Pro and tried putting in new payment info. It didnt push through as it was asking me to key in my lost security code number
4. I opened my ipad and it was asking for the same thing bec my apple ID was accessed elsewhere with the attempt to change my payment info.
5. I couldt download and purchase apps because of this, i havent downloaded pertinent software for my new computer.
Could you please help me resolve this problem?
Thank you very much
Ana

Contact iTunes Customer Service and request assistance with your issue.
Apple Support iTunes Store Contact Us

I can edit a pdf in Acrobat 9.2 but cannot in Acrobat 11 ( says its secured and I need password)? CCard company know nothing about passwords on PDF statement.

How can I edit my CCard statement (pdf) in Acrobat 11 (MAC)
when it says it is secured? I can edit in Acrobat 9.2 on my PC.

Hi Doug ,
Protected PDF' cannot be edited until and unless the they ain't unlocked or the the password is entered.
PDF' are secured so that nobody else misuses it .
If you are creator of that PDF ,you would certainly be knowing the password.
If not ,then please request the creator to tell you the password in order to edit it.
Regards
Sukrit Dhingra

Letting a virus email through its security

It is a email titled FED EX and this is a Serious Malware Virus Rogue:Win32/Winwebsec and ius getting through the firefox support security check with being clear and not fagging or saying suspisious email not verified ! ! Tgis Got me once but it keeps appearing and checking out to be safe through ur security check

We never sent this type of email..please ignore them..try to reset your email password and set a strong password. Please follow all of the universally recognized rules of safe computing, and youwill be good. Keep Windows and all applications up to date, stay away from cheesy websites, no piracy, etc etc etc
Firefox 10
* getfirefox.com

Firefox is asking me to add an exception for security for a website that has told me its certificate is valid.

I am running Firefox 31.0 on a Windows 8.1 o/s. When I attempt to access my email provider in its' "secure" mode, I am advised that the connection is untrustworthy. (Parenthetically, this does not occur on my other two systems running respectively, Windows 7 and Windows XP.) I am asked to provide an authorization for an 'exception' prior to completing the connection. The option of making the exception permanent is NOT available, so I go through this every time I begin a new internet session. I have contacted the email provider and been advised that their digital certificate is valid. So, as I see it there are three problems: (1) if the certificate is valid, as is suggested by the provider, why does Firefox not recognize this, (2) why does the exception window not allow me the option to make the exception status enduring, and (3) why is this problem present only on my Windows 8.1 system?

Try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.
If that helped to solve the problem then you can remove the renamed cert8.db.old file.
Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates.
Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.
If that didn't help then remove or rename secmod.db (secmod.db.old) as well.

How do I use Oracle Database Security in my HTML DB App?

I have an existing client server application that each user has a database account. These accounts are set up currently to allow and disallow appropriate access to data via Database Rolls. I want to augment the client server application with a HTML DB application and want to use the already created database accounts. Can this be done?

Chris,
HTML DB parses the SQL and PL/SQL in your application as the "parse as" schema, or owner, of the application. The new database session created for each page view runs for the connected user HTMLDB_PUBLIC_USER (for DADs with stored credentials) or for the user authenticated by the basic authentication challenge (your situation).
You can access the USER pseudo-column within the session to set audit columns with the name of the connected user. This is not the name of the application schema.
Basic Authentication is not the only way to authenticate against database accounts. You can easily implement a login page of your own with a PL/SQL process that checks the user's credentials against the database account. Our team implemented HTML DB extensions to (and ultimately replacements for) a very complex Forms-based system having an architecture probably very similar to yours. In this environment we would set the APP_USER item to the authenticated username and use it for audit columns and for authorization checks within the application. During this 2-year project, we adopted a couple of best practices that you might want to consider: 1) All DML is performed using table-level APIs (which are easy to generate automatically), and 2) Table-level APIs are called only from transaction-level APIs, which often involve multiple calls to table-level APIs. We would implement all authorization checks at the transaction level, either within the APIs themselves, or also on the HTML DB controls around them (buttons, processes, etc.). Abstracting the security rules away from the database objects allowed them to be formulated in terms of business processes and relates them more closely to the logical data model.
That's an approach you can think about. If you do continue to use basic authentication and direct or role-enabled object privileges, you can still make your DML, triggers, and APIs user-aware as I noted above or by using invoker's rights packages/procedures.
Finally, HTML DB is not a client-server emulation tool. Its security model facilitates flexible and secure database access appropriate for a declarative development environment (possible hosted) and application deployment to web-based users.
Do let us know if we can help with specific issues as you go forward.
Scott

HT201363 I would like to log into an old Apple ID account and forgot the password but it is no longer active and I forget the answers to the security questions. How do I log in?

I Want my music from my old Apple ID account but I can't remover my password and the email is not active so I can't log onto it. I don't remember my security question answers. What should I do? Am I logged out forever?

You need to ask Apple to reset its security questions. To do this, click here and pick a method; if that page doesn't list one for your country or you're unable to call, fill out and submit this form.
(115690)

HT201363 I HAVE AN ICLOUD ACCOUNT THAT I WISH TO DELETE BUT I'VE FORGOTTEN THE PASSWORD AND THE SECURITY QUESTIONS. THE EMAIL ADDRESS I USED IS NO LONGER ACTIVE

I HAVE AN ICLOUD ACCOUNT THAT I NEED TO DELETE, BUT I'VE FORGOTTEN THE PASSWORD AND/OR THE SECURITY QUESTIONS. SO, I CAN'T RESET IT BY EMAIL BECAUSE THE ADDRESS I USED IS NO LONGER ACTIVE.

You need to ask Apple to reset its security questions. To do this, click here and pick a method; if that page doesn't list one for your country or you're unable to call, fill out and submit this form.
(115690)

How to use security roles in Weblogic server?

Hello Gurus,
I am new to Weblogic server and I am trying to investigate how to make
use of security roles in weblogic server (5.1.0). Can anyone point me
to some documentation. Specifically, I am looking for instance level,
and method level security and how to use it.
Thanks for taking your time to read this e-mail.
Thank You all in advance,
Hari.

You should read the security information in the Servlet 2.2 specification
that WL 5.1 implements:
http://java.sun.com/products/servlet/download.html
Chapter 11 deals with declarative and programmatic security, and includes a
section on roles:
11.4 Roles
A role is an abstract logical grouping of users that is defined by the
Application Developer or
Assembler. When the application is deployed, these roles are mapped by a
Deployer to security
identities, such as principals or groups, in the runtime environment.
A servlet container enforces declarative or programmatic security for the
principal associated with
an incoming request based on the security attributes of that calling
principal. For example,
1. When a deployer has mapped a security role to a user group in the
operational environment. The
user group to which the calling principal belongs is retrieved from its
security attributes. If the
principal's user group matches the user group in the operational environment
that the security
role has been mapped to, the principal is in the security role.
2. When a deployer has mapped a security role to a principal name in a
security policy domain, the
principal name of the calling principal is retrieved from its security
attributes. If the principal is
the same as the principal to which the security role was mapped, the calling
principal is in the
security role.
Cameron Purdy
http://www.tangosol.com
"Hari" <[email protected]> wrote in message
news:[email protected]..
Hello Gurus,
I am new to Weblogic server and I am trying to investigate how to make
use of security roles in weblogic server (5.1.0). Can anyone point me
to some documentation. Specifically, I am looking for instance level,
and method level security and how to use it.
Thanks for taking your time to read this e-mail.
Thank You all in advance,
Hari.

HT201413 I keep error 9 when i try to restore my Ipod 5.It seems to be that my device disconnects during the restore process, then error messege pops up. I have updated the security settings on my pc and it still doesn't work.

Error 9 pops up when trying to restore Ipod 5. The problem seems to be that my ipod disconnects during the restore process. My ipod is stuck in restore mode so I can't access its update serever. I have already updated my pc and its security settings. Is there anything else i can try?

Hello AS234,
This error is typically indicative of a conflict with installed security software.
Configure your security software
Check your security software and settings, which can block ports and prevent connection to Apple servers during update and restore.
Common errors: 2, 4, 6, 9, 1000, 1611, 9006, 9807, 9844. Sometimes as a result of this issue, a device might stop responding during the restore process.
Resolve specific iTunes update and restore errors
http://support.apple.com/kb/TS3694
Cheers,
Allen

Adding pages in Acrobat 9 Pro (secured document)

I am about to switch to a new computer. The old one had Acrobat 8 Professional and the new one has Acrobat 9 Pro.
I produce a certain kind of files where, after I have printed it to a pdf, I take a copy of the pdf. One of the files I leave as it is, the other one (with a slight namechange, I add a blank page to every other page.
This is how I did it in Acrobat 8:
Open the file
Change the security setting (temporarily remove it so I can add pages, when I close the file the security is automatically turned on again)
Click on Pages/Options/Insert page
Go to the place where I have my one blank page (with no security added)
Insert it after page 1
Ctrl-click and drag so I copy the page to every other page.
Save and close
When I try to do this in 9 the following happens:
First when I go to Pages/Options/Insert page I have to choose "from file". Irritating with extra more step, but I can live with that.
I add the empty page after page 1 and then try to ctrl-click and drag, but it doesn't work. I get an error message that I will try to translate (I am Swedish):
"Pages retrieved from a secured file looses its security settings. Do you want to continue?"
What is this? I have temporarily removed the security settings (Secure/Show security properties/Change Settings/fill in password/OK/Cancel) just as it says in the help file. If I the click on Secure, all is permitted. When I save and exit and reopen that file, the security is there again.
As it is temporarily without security this should work as in Acrobat 8!!
I now have 2 options:
1. Add the empty page after every other page manually (Insert page instead of copying the one I already inserted)
or
2. Permanently remove the security and then remember to turn it on (lots of steps) before I save the file.
The files are usually about 20 pages, so I have to do step 1 10 times.... I usually do about 15-20 of these files at one time, so this is a problem that will be very time consuming for me.
Could someone please tell me what's happening and maybe give me an idea about a way to work around it?
Lena, Sweden

The reason every other page must be blank is because the files are start-up reports for climate control units, that the technician has to fill in. We print it as a book and as every other page is blank, only the right hand pages are printed. Then the technician can have the report on a hard board and easily fill in/go to the next page. I have done this exactly the same way since Acrobat 5, and I have done it this way for so long time now that I am afraid I will forget to turn it on again one I have turned it off...
The reason why I don't make the document with blank pages from the beginning is that the report must be in 2 versions; one with the empty pages for us to print when a customer buys a unit, and one without that we have on our web-site, for the customers to download. Also, I have about 1.000 of these reports so adding a lot of blank pages in FrameMaker (where I make them) is a time-consuming job. Better to add the pages after I have produced the pdf, then I don't need double FM-files (and don't need to change in 2 documents when I have to change something).
Clerarer now?
Lena

How do you know your wireless is secure?

I want to know how you know your internet is secure so no one in your neighbor hood can steal or hack my internet service. A few people in our house use a mix between ethernet cable and wireless. I don't use the wireless so i don't know how you set it up on the computer but when you use wireless for the first time to you have to enter a user name and password to access? I just want to make sure its secure. Thank you

Prevent someone from hacking your network.. simple, dont use wireless at all and turn the wireless on the router off. Thats the only option to prevent hacking. All other security settings like WEP, WPA, WPA2 will only slow a hacker down. They will not stop them.
Now if you want wireless, then your only option is to use encryption. Again this will only slow hackers down. But the chances you have a hacker next door is rather remote. Now by default the Verizon router uses WEP security. This is just the basics. Keeps honest people honest. Now if you want to increase your security, you can change the router security to WPA2. Dont worry about WPA as this is basically the same as WEP in terms of security effectiveness. WPA2 is more secure than the other two. This will keep you safe from the novices. Then as long as you dont have an advanced computer user nearby you should be fairly safe.
====================================================================================
Error exists between keyboard and chair.

IPhone's Wi-Fi Keeps Disconnecting Since Securing My Network

All my iPhone's have been on my home Wi-Fi for four years with no problem. Now, that I've just added a password onto my network, I keep getting disconnected on the iPhone and have to keep entering the password to reconnect.
Anyone know what this is about?

What make/model router do you have?
Does this router have the latest firmware from the router manufacturer? Check the manufacturer's support web pages.
What type of security are you using? WEP, WPA, WPA2 (WEP is not recommended)
If your router is four years old and has never had a firmware update there may be bugs in its security code or it may just be at the end of its life.

ITS Security

Similar Messages

Maybe you are looking for