How to Create a Better Malware Warning Through Psychology

It turns out the best way to get people to pay attention to those malware warnings that pop up in browsers may be to stop tweaking them, scrap them entirely and rebuild from scratch. According to a study on the subject published last week, efficient malware warnings shouldn’t scare users away, th...

Microsoft ASP.NET SignalR CVE-2013-5042 Cross Site Scripting Vulnerability

Description Microsoft ASP.NET SignalR is prone to a cross-site scripting vulnerability because it fails to properly encode user input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow...

Character encoding cross-origin XSS attack — Mozilla

Security researcher Masato Kinugawa discovered that if a web page is missing character set encoding information it can inherit character encodings across navigations into another domain from an earlier site. Only same-origin inheritance is allowed according to the HTML5 specification. This issue...

bugs in IJG jpeg6b & libjpeg-turbo

Dearly beloved, So, for one reason or another, the IJG jpeg library has gained some notoriety as one of the most robust pieces of complex, security-critical C code. Despite countless fuzzing efforts, I don't recall any reports of serious vulnerabilities at least since the release of jpeg6b in 199...

[SECURITY] [DSA 2797-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2797-1 [email protected] http://www.debian.org/security/ Michael Gilbert November 16, 2013 http://www.debian.org/security/faq -...

Google Chrome adds automatic malware blocking for suspicious downloads

Today Malware is a very real threat, and if you're not careful about what you download and install, you could end up with a serious problem. But now Google will be trying their very best to block malware from installing itself on your computer on your behalf. Google has developed a security featu...

Google Chrome to Automatically Block Malicious Downloads

Google is planning to add a new feature to its Chrome browser that will block malicious downloads automatically, helping to prevent drive-by downloads and the kind of malware that rides along with supposedly legitimate software. The new addition to Chrome already is in the development queue,...

mod_pagespeed -- critical cross-site scripting (XSS) vulnerability

modpagespeed developers report: Various versions of modpagespeed are subject to critical cross-site scripting XSS vulnerability, CVE-2013-6111. This permits a hostile third party to execute JavaScript in users' browsers in context of the domain running modpagespeed, which could permit theft of...

Mozilla Firefox 9.0.1 - Same Origin Policy Security Bypass

Mozilla Firefox 9.0.1 - Same Origin Policy Security Bypass source: https://www.securityfocus.com/bid/62480/info Mozilla Firefox is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass the same-origin policy and certain access restrictions to access data, or execute...

BEAST Cryptographic Attack Mitigations Overturned

The BEAST cryptographic attack, once thought to be largely mitigated, has two things conspiring against it to make breaches potentially possible again. Not only has a server-side mitigation essentially been rendered moot by recent research into the RC4 cryptographic protocol, but Apple has yet to...

Microsoft Windows Object Linking and Embedding (OLE) Remote Code Execution Vulnerability

Description Microsoft Windows Object Linking and Embedding OLE is prone to a remote code-execution vulnerability. Successful exploits will allow the attacker to execute arbitrary code in the context of the user running the application, which can compromise the application, and possibly, the...

Microsoft SharePoint CVE-2013-3179 Multiple HTML Injection Vulnerabilities

Description Microsoft SharePoint is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based...

Microsoft FrontPage CVE-2013-3137 Information Disclosure Vulnerability

Description Microsoft FrontPage is prone to an information-disclosure vulnerability. Attackers can exploit this issue to disclose the contents of a local file on the affected computer. This may aid in further attacks. Technologies Affected Microsoft FrontPage 2003 SP3 Recommendations Run all...

Microsoft SharePoint CVE-2013-3180 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Hewlett-Packard LoadRunner micWebAjax.dll ActiveX Control NotifyEvent Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP LoadRunner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the micWebAjax.dll...

Microsoft Internet Explorer CVE-2013-3186 Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. An attacker can exploit this issue in conjunction with other latent vulnerabilities to execute arbitrary code with elevated privileges. Technologies Affected Avaya Aura Conferencing Standard Avaya CallPilot...

CVE-2013-1709

CVE-2013-1709 is a Firefox/XUL/SeaMonkey family XSS issue caused by improper handling of FRAME elements and history, allowing remote attackers to spoof a relative location in a previously visited document. Affected products are Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderb...

Mixed Content Blocking Appears in Firefox 23

The long-anticipated inclusion of mixed-content blocking in Mozilla Firefox is now at hand, with the security feature showing up in the just-released Firefox 23. The feature, which helps defend users against certain kinds of man-in-the-middle attacks, is on by default in the new browser. Mixed...

Microsoft Internet Explorer CMshtmlEd Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Internet Explorer CTreeNode Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within a...