Gumblar Attacks Spread to Thousands of New Sites

Gumblar, the nasty bit of malware that was part of a mass SQL injection on legitimate Web sites this spring, is continuing to spread and its creators have been busy lately, compromising hundreds of new sites, leading to a massive new wave of infections of end-user PCs. Gumblar first hit the scene...

Preemptive Protection against Adobe Reader and Acrobat Mozilla plug-in Remote Code Execution Vulnerability (APSB09-15)

A remote code execution vulnerability has been discovered in Adobe Reader and Acrobat. A remote attacker could implant a shell code on a target system using heap spray exploitation method. Heap spraying is a technique for exploiting vulnerabilities in internet browsers e.g. Internet Explorer,...

Adobe Acrobat < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)

The version of Adobe Acrobat installed on the remote host is earlier than 9.2 / 8.1.7 / 7.1.4. Such versions are reportedly affected by multiple vulnerabilities : - A heap overflow vulnerability. CVE-2009-3459 - A memory corruption issue. CVE-2009-2985 - Multiple heap overflow vulnerabilities...

Mozilla Browsers CSS moz-binding Cross Domain Scripting (CVE-2006-0496)

The Mozilla based web browsers are full featured web browsers which serve as popular alternatives to the Microsoft Internet Explorer. The browsers are capable of interpreting HTML, JavaScript, CSS, as well as a myriad of other popular Internet standard formats. The Mozilla based browsers are...

New vulnerabilities in OpenX

Hello 3APA3A! I want to warn you about Denial of Service, Cross-Site Scripting and Redirector vulnerabilities in OpenX. DoS Looped DoS: http://site/adclick.php About Looped DoS I wrote in my classification of DoS vulnerabilities in web applications http://websecurity.com.ua/2663/. Vulnerable are...

Mozilla Firefox IFRAME Cross Site Scripting (CVE-2005-1476)

Mozilla browsers use the W3C Document Object Model DOM to provide a structural representation of an HTML document and define the way this structure is to be accessed from scripts. One of the core objects exposed by DOM is the window object, which is used to represent a browser window. An HTML pag...

Mozilla Releases Preview Builds of Firefox with Content Security Policy

Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks. The CSP specification is Mozilla’s effort to provide Web site operators with a simpler way to...

Firefox Add-on Spies on Google Search Results

Security researchers have intercepted a fake Flash Player update creating a Firefox add-on that spies on the user’s Google search results. The malicious Firefox extension, called “Adobe Flash Player 0.2,” injects ads into the user’s Google search results pages and even has the capability to monit...

DoS in multiple browsers

Hang or crash on oversized location.hash...

RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2008:0132)

Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.4.2 SR10 Java release includes the IBM...

RHEL 3 / 4 / 5 : flash-plugin (RHSA-2008:0221)

An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security...

Serious Cracks Showing in SSL, AES

The cryptographic underpinnings of the Internet are beginning to show some serious wear, and the outlook for better days ahead is not particularly rosy. In just the last week there has been news of major new attacks on perhaps the two most widely used encryption technologies: SSL and AES. We’ve...

Multiple browsers DoS

select method doesn't limie the number of selected elements, leading to resources exhaustion...

Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....

One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Update/Changes : ---------------- Backround : + I failed to include details about the nature of the bug DOM, the root cause is a DOM flaw and not a Javascrip...

Multiple browsers DoS

Crash or resources exhaustion on oversized unicode string operations via Javascript...

New DOM Flaw Can Crash IE, Other Major Browsers

From The H Security The Luxembourg security specialists G-SEC have published details of a vulnerability in the majority of browsers which will either crash the browser or consume so much memory that it makes the computer virtually unusable. The trick is simple. Using JavaScript’s DOM Document...

[GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....

One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - One bug to rule them all WWW :...

Multiple Web Browsers Denial of Service Exploit (1 bug to rule them all)

No description provided by source. One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - One b...

Awingsoft Awakening Winds3D Viewer remote command execution vulnerability

Advisory ID Internal CORE-2009-0519 1. Advisory Information Title: Awingsoft Awakening Winds3D Viewer remote command execution vulnerability Advisory ID: CORE-2009-0519 Advisory URL:http://www.coresecurity.com/content/winds3d-viewer-advisory Date published: 2009-07-08 Date of last update:...

Mozilla Tackles XSS Vulnerabilities, Clickjacking Attacks

Mozilla’s security engineers are working on new technology that promises to mitigate a large class of Web application vulnerabilities, especially the cross-site scripting XSS plague against modern Web browsers. The project, called Content Security Policy, is designed to shut down XSS attacks by...