The worst security hole I've seen was from a (very very bad) hosting company. And even worse it was just some months ago (summer 2010)! You had to first connect to your hosting package control panel (you needed valid credentials). Once logged in all you had to change was the id GET token from the URL and voilà, you're in the control panel of another user! You have access (save/edit/delete) to emails, files, databases. The ids were sequential so you only have to do +1 and you're in the next account. I hope someone have been fired for this!

这是我和他们一起经历过的众多WTF之一!幸运的是，我不是他们的顾客!

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

有关安全漏洞(和其他计算机风险)的主列表，请访问http://catless.ncl.ac.uk/Risks

在文本框中输入1=1将列出系统中的所有用户。

当关键IT员工离开公司时，不更改管理密码。

我所见过的最糟糕的漏洞是web应用程序中的一个漏洞，即提供空用户名和密码将以管理员身份登录。