CVE-2011-0921

crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname, domain, and username, which allows remote attackers to execute arbitrary code by sending unspecified data over TCP, related to the webreporting client, the...

PT-2011-2764

Name of the Vulnerable Software and Affected Versions HP Data Protector affected versions not specified Description The issue is related to the improper validation of credentials associated with the hostname, domain, and username in the Cell Manager Service of HP Data Protector. This allows remot...

SuSE 10 Security Update : flash-player (ZYPP Patch Number 6844)

The following bug has been fixed: Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests CVE-2010-0186. The update also fixes a denial of service condition. CVE-2010-0187 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description...

Signed Applet Social Engineering - Code Execution (Metasploit)

$Id: javasignedapplet.rb 11516 2011-01-08 01:13:26Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CVE-2010-3796

CVE-2010-3796 affects Safari RSS in Mac OS X 10.5.8 and 10.6.x prior to 10.6.5. A Java applet in an RSS feed could modify the DOM, allowing remote attackers to obtain sensitive information via a crafted feed URL. The issue is mitigated in 10.6.5 and later (Apple Security Update HT4435; addressed ...

PT-2010-5083

Name of the Vulnerable Software and Affected Versions Safari versions prior to 10.6.5 in Mac OS X 10.5.8 and 10.6.x Description The issue allows remote attackers to obtain sensitive information by using a feed: URL containing a Java applet that performs DOM modifications, as Safari does not block...

USN-1010-1: OpenJDK vulnerabilities

Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a machine-in-the-middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user's session. USN-923-1 disabled SSL/TLS renegotiation...

Java Multiple Issues

Hi all and sorry for cross post, after several months since I contacted Oracle informing them about ten issues on Java applet security, they finally released an Java 6 update 22 which fixes several security issues In particular the issues are the following, sorted by impact: Information Disclosur...

Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass

, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Oracle JRE - java.net.URLConnection class – Same-of-Origin SOP Policy Bypass PDF: http://www.security-assessment.com/files/advisories/OracleJREjavaneturlconnectionSOPBypass.pdf CVE...

Oracle JRE - java.net.URLConnection class Same-of-Origin Policy Bypass

Exploit for windows platform in category remote exploits ======================================================================== Oracle JRE - java.net.URLConnection class Same-of-Origin Policy Bypass ======================================================================== Description...

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when...

Oracle JRE - java.net.URLConnection class Same-of-Origin 'SOP' Policy Bypass

Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when communication occurs between two domains that resolve to the same IP address. Thi...

Oracle Java APPLET Tag Memory Corruption

Source: http://skypher.com/index.php/2010/10/13/issue-18-oracle-java-applet-childre/ o=document.createElement"applet"; setTimeoutfunction x=o.children; location.reload; , 1; Tested with: Windows XP sp3 5.1.2600 MSIE 7.0.5730.13 MSIE 8.0.6001.18702 Sun Java Version 6 Update 20 1.6.020-b02...

Oracle Java APPLET Tag Children Property Memory Corruption

Exploit for windows platform in category dos / poc ========================================================== Oracle Java APPLET Tag Children Property Memory Corruption ========================================================== Source:...

Oracle Java - APPLET Tag Children Property Memory Corruption

Oracle Java - APPLET Tag Children Property Memory Corruption Source: http://skypher.com/index.php/2010/10/13/issue-18-oracle-java-applet-childre/ o=document.createElement"applet"; setTimeoutfunction x=o.children; location.reload; , 1; Tested with: Windows XP sp3 5.1.2600 MSIE 7.0.5730.13 MSIE...

Oracle Java - APPLET Tag Children Property Memory Corruption

Source: http://skypher.com/index.php/2010/10/13/issue-18-oracle-java-applet-childre/ o=document.createElement"applet"; setTimeoutfunction x=o.children; location.reload; , 1; Tested with: Windows XP sp3 5.1.2600 MSIE 7.0.5730.13 MSIE 8.0.6001.18702 Sun Java Version 6 Update 20 1.6.020-b02...

Oracle Java IE Browser Plugin docbase Parameter Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Oracle Java Runtime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Sun Java - JRE AWT setDiffICM Buffer Overflow (Metasploit)

$Id: javasetdifficmbof.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Sun Java - Calendar Deserialization (Metasploit)

$Id: javacalendardeserialize.rb 10389 2010-09-20 04:38:13Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Firefox Plugin Parameter EnsureCachedAttrParamArrays Code Execution

Exploit for windows platform in category dos / poc =================================================================== Firefox Plugin Parameter EnsureCachedAttrParamArrays Code Execution =================================================================== Title : Firefox Plugin Parameter...