Mozilla Firefox/Thunderbird/SeaMonkey Proxy Authentication Session Fixation Vulnerability

Firefox/Thunderbird/SeaMonkey are web browsers and mail/newsgroup clients released by Mozilla. A session fixation vulnerability exists in Mozilla Firefox/Thunderbird/SeaMonkey, which can be exploited by an attacker to hijack arbitrary sessions and gain unauthorized access to affected applications...

Google Chrome Denial of Service Vulnerability (CNVD-2015-00077)

Google Chrome is a simple and efficiently designed web browsing tool developed by Google. A denial of service vulnerability exists in versions of Google Chrome prior to 11.0.696.65, which allows remote attackers to launch a denial of service attack via SVG documents...

Mozilla Browsers JavaScript Argument Passing Code Execution - Ver2 (CVE-2007-0777)

Mozilla Firefox and Seamonkey are very popular open source web browsers from Mozilla Foundation, based on the Mozilla Suite code base. The browser is an application designed for tasks related to web browsing, such as displaying HTML pages, downloading files, rendering different media, and so on...

New Android Browser Vulnerability Is a “Privacy Disaster” for 70% Of Android Users

A Serious vulnerability has been discovered in the Web browser installed by default on a large number Approximately 70% of Android devices, that could allow an attacker to hijack users' open websites, and there is now a Metasploit module available to easily exploit this dangerous flaw. The exploi...

Facebook Self-XSS Scam Fools Users into Hacking Themselves

Scammers have again targeted more than one billion active users of the popular social networking giant Facebook, to infect as many victims as possible. Not by serving fake post, neither by providing malicious video link, instead this time scammers have used a new way of tricking Facebook users in...

JShop E-Commerce Suite 1.2 Product.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12403/info JShop E-Commerce Suite is affected by a cross-site scripting vulnerability in the 'product.php' script. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link...

phpldapadmin 0.9.8 - template_engine.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17643/info PHPLDAPAdmin is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to execute...

All browsers 0day Crash Exploit

No description provided by source. =============================== All browsers 0day Crash Exploit =============================== + Discovered By: Inj3ct0r Team @Title: All browsers 0day Crash Exploit @Site: http://site.securityspl0its.com/ - http://forum.securityspl0its.com/ -...

Opera 6.0.1,MS IE 5/6 JavaScript Modifier Keypress Event Subversion Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5290/info An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious JavaScript may subvert some keypress events, with consequences...

Maxthon Browser 1.x Content-Type Buffer Overflow Vulnerability

source: http://www.securityfocus.com/bid/30617/info Maxthon Browser is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition...

webSPELL 4.1.2 - 'index.php' Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28294/info webSPELL is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

FLV Players 8 popup.php url Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/18954/info FLV Player is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

SQLite Browser 2.0b1 - Local DoS Vulnerability

No description provided by source. Exploit Title: SQLite Browser 2.0b1 Local DoS Vulnerability Author: Nishant Das Patnaik Tested on: Windows XP SP2/SP3 x86, Vista x86, Windows 7 x64 Code : A specially crafted SQL file query can cause the the application to freeze and finally crash. The bug is th...

LifeType 1.2.10 HTTP Referer stored XSS

No description provided by source. Exploit Title: lifetype 1.2.10 http referer XSS Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.php results in a cross site...

ProfitCode Software PayProCart 3.0 AdminShop HDoc Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13305/info PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary...

Mail.ru: [corp.mail.ru] CRLF Injection / Insecure nginx configuration

Сценарий перенаправления с http://corp.mail.ru/ на http://corp.mail.ru/ru/ уязвим к атаки типа CRLF Injection. PoC Установка cookie test=test на .mail.ru Подвержены все браузеры, кроме FireFox http://corp.mail.ru/%0dSet-Cookie:test=test;domain=.mail.ru; Может быть использовано в комбинации с...

Debian Security Advisory DSA 2930-1 (chromium-browser - security update)

Several vulnerabilties have been discovered in the chromium web browser. CVE-2014-1740 Collin Payne discovered a use-after-free issue in chromium's WebSockets implementation. CVE-2014-1741 John Butler discovered multiple integer overflow issues in the Blink/Webkit document object model...

Apple's iOS vulnerable to Man-in-the-middle Attack, Install iOS 7.0.6 to Patch

Apple's latest 35.4 MB update of iOS 7.0.6 doesn't seem important at first, but it contains a critical security patch that addresses a flaw with SSL encryption. Yes, a very critical security vulnerability that could allow hackers to intercept email and other communications that are meant to be...

Modern Browser XSS Filter Evasion

Modern browsers usually have an antiXSS filter, that protects users from some of the consequences of this kind of attacks. Normally, they block cross site scripting execution, so the "injected" code normally, JavaScript or HTML is not executed inside victim's browser. Chrome calls this filter...

MGASA-2013-0321 Updated chromium-browser-stable packages fix multiple vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities: Atte Kettunen of OUSPG discover a use-after-free issue in Blink's XML HTTP request implementation CVE-2013-2925. cloudfuzzer discovered a use-after-free issue in the list indenting implementation CVE-2013-2926. cloudfuzzer...