PT-2011-3640

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain sensitive information by exploiting a "cross-domain Referer leakage" issue. This is achieved through GET requests with query strings for specific API...

PT-2011-3641

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows context-dependent attackers to discover credentials by reading web-server access logs, web-server Referer logs, or the browser history, due to the support of URLs containing...

A DNS suffix may lead to cross-domain security issues-vulnerability warning-the black bar safety net

We all know that dhcpd can be set in which the client's DNS suffix. For example, if we set the DNS suffix"sb.com”when we visit www. sb. com, all clients will use the DHCP server and try the following sequence for resolution. Note: the following green font are representative of the Main Domain Nam...

Researchers Warn of Security Issues in WebGL Standard

Security researchers are warning users that there are a number of vulnerabilities and potential problems with WebGL, and emerging standard for 3D rendering on the Web, that could cause serious problems for users. The weaknesses in WebGL range from denial-of-service problems to cross-domain file...

WebGL Security Risks

US-CERT is aware of reports indicating that WebGL contains multiple significant security issues. The impact of these issues includes denial of service, and cross-domain attacks. WebGL is a new web standard that is enabled by default in Firefox 4 and Google Chrome and is included in Safari. US-CER...

Microsoft IE JavaScript跨域信息泄露漏洞(MS11-018)

BUGTRAQ ID: 47192 CVE ID: CVE-2011-1245 Windows Internet Explorer，原称Microsoft Internet Explorer，简称MSIE（一般称为Internet Explorer，简称IE），是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer JavaScript在实现上存在跨域信息泄露漏洞，远程攻击者可利用此漏洞访问其他域或安全区域内的内容，获取敏感信息。...

PT-2011-2983 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 7 Description: The issue allows remote attackers to obtain sensitive information via a crafted web site. An information disclosure vulnerability exists that could allow script to gain access to...

Microsoft Internet Explorer JavaScript Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability, An attacker can exploit this issue to access content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information which may aid in...

Microsoft Internet Explorer Frame Tag Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability, An attacker can exploit this issue to access content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or may aid in further...

WebKit 1.2.x - Local Webpage Cross Domain Information Disclosure

source: https://www.securityfocus.com/bid/46816/info WebKit is prone to a cross-domain scripting vulnerability because it fails to properly enforce the same-origin policy. Successfully exploiting this issue will allow attackers to send the content of arbitrary files from the user's system to a...

WebKit 1.2.x - Local Webpage Cross Domain Information Disclosure

WebKit 1.2.x - Local Webpage Cross Domain Information Disclosure source: https://www.securityfocus.com/bid/46816/info WebKit is prone to a cross-domain scripting vulnerability because it fails to properly enforce the same-origin policy. Successfully exploiting this issue will allow attackers to...

Web Site Cross-Domain Policy File Detection

Binary data 5801.prm...

CVE-2011-0694

RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrows...

CVE-2011-0694

RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrows...

CVE-2011-0694

RealNetworks RealPlayer (Windows) with versions 11.0–11.1.1.x/SP 1.0–1.1.5 and 14.0.0–14.0.1, plus Enterprise 2.0–2.1.4, is affected by CVE-2011-0694. The flaw is in the temporary-file naming scheme used to store references to Real Media files, which is easily predictable and can be brute-forced ...

CVE-2011-0694: Undefined Security Weakness

RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrows...

PT-2011-2564

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.5 RealPlayer versions 14.0.0 through 14.0.1 RealPlayer Enterprise versions 2.0 through 2.1.4 Description The issue allows remote attackers to conduct cross-domain...

SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6879)

This update of acroread fixes : - Cross-domain request vulnerability CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified vulnerability that possibly allowed remote code execution. CVE-2010-0186: CVSS v2 Base Score: 5.8 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of...

SuSE 10 Security Update : flash-player (ZYPP Patch Number 6844)

The following bug has been fixed: Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests CVE-2010-0186. The update also fixes a denial of service condition. CVE-2010-0187 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description...

Android Content Provider File Disclosure

This module exploits a cross-domain issue within the Android web browser to exfiltrate files from a vulnerable device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Content Provider...