Cenzic released its report revealing the most prominent types of Web application vulnerabilities for the second half of 2008. The report, which comes in the wake of highly publicized Web attacks, including Heartland, Twitter, and Facebook, as well as $355M in funding from President Obama’s stimulus package to bolster cyber security, details the newest methods that hackers are using to exploit Web technologies on a massive scale.

The recent Web attacks on prominent organizations have affected millions and drawn worldwide media attention, shedding light on how easily even sites that are believed to be secure, can be compromised. For example, earlier this month a file containing the blueprints and avionics package for Marine One was found on a computer in Iran.

It appears that the files were compromised when a government contractor used an infected peer-to-peer file sharing program. In so many of these attacks common vulnerabilities including SQL injection, cross-site scripting and denial of service are easily exploited.

Findings from the report point out the continued growth of vulnerabilities and growth of attacks through Web applications. Most notably, the total number of reported vulnerabilities went up to 2,835, an increase of more than 10 percent from the first half, of which the percentage of vulnerabilities relating to Web applications hit a staggering 80 percent.

The top 10 vulnerabilities for the second half of 2008 included the familiar names such as Adobe, Microsoft, Mozilla, Apache, and Oracle, where most Web applications were found to have vulnerabilities related to information leaks and exposures, Cross-Site Scripting, and session management.

Some key findings include:

• Of Web browser vulnerabilities, Internet Explorer had the highest percentage at 43 percent followed closely by Firefox at 39 percent. As in previous reports, Safari and Opera continue to report fewer vulnerabilities at 10 and 8 percent respectively.
• Eighty percent of the total reported vulnerabilities affected Web technologies, such as Web servers, applications, Plugins and ActiveX, and Web browsers, which is a significant increase from earlier in the year.
• Adobe continued to be plagued by vulnerabilities some of which showed up in our Top 10 list. Others on this list included SAP, Microsoft, Mozilla, Sun, Apache, and Oracle.

To download a PDF version of the Q3-Q4 Trend Report click here.