PT-2011-4098

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 13.0.782.107 Description The issue allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak." This occurs because Google Chrome does not...

CVE-2011-2795

Google Chrome before 13.0.782.107 is vulnerable to a cross-frame function leak that allows remote attackers to bypass same-origin access restrictions via a crafted web site; remediation is to upgrade to 13.0.782.107 or later.

CVE-2011-2795

Removed by vendor...

PT-2011-4104

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 13.0.782.107 Description A use-after-free issue allows remote attackers to cause a denial of service or possibly have other unspecified impacts via vectors related to the frame loader. Recommendations For versio...

Stable Channel Update

The Google Chrome team is pleased to announce the arrival of Chrome 13.0.782.107 to the Stable Channel for Windows, Mac, Linux, and Chrome Frame. Spanning 5200+ revisions, Chrome 13 contains some exciting new features like Instant Pages prerendering technology. To find out about other new feature...

CVE-2011-2892: Improper Input Validation

Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

PT-2011-4178

Name of the Vulnerable Software and Affected Versions Joomla! versions 1.6.0 through 1.6.1 Description The issue allows remote attackers to conduct clickjacking attacks via a crafted web site, as it does not prevent page rendering inside a frame in a third-party HTML document. Recommendations For...

CVE-2011-1478

The napireuseskb function in net/core/dev.c in the Generic Receive Offload GRO implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service NULL pointer dereference via a malformed VLAN fra...

Enable X-FRAME-Options header to implement clickjacking protection

TLDR: Add X-FRAME-Options: SAMEORIGIN to all HTTPS pages server config, and test that nothing breaks. --- Description: Current HTTP headers do not contain the X-FRAME-Option, which helps prevents against Clickjacking attacks. A Clickjacking attack is similar to CSRF in which attacker can hijack a...

Enable X-FRAME-Options header to implement clickjacking protection

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-25143. panel TLDR: Add X-FRAME-Options: SAMEORIGIN to all HTTPS pages server config, and test that nothing breaks. --- Description: Current...

Enable X-FRAME-Options header to implement clickjacking protection

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-25143. panel TLDR: Add X-FRAME-Options: SAMEORIGIN to all HTTPS pages server config, and test that nothing breaks. --- Description: Current...

Apple Safari Update Fixes 58 Bugs, Adds Sandboxing

Along with the release of their new Lion OS X, Apple has issued a new version of its Safari browser for Mac and Windows users, pushing version 5.1 and 5.0.6 to patch a boatload of security holes, some of which are critical. Fifty-eight security vulnerabilities in total are addressed in the update...

CVE-2010-4554

functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2011-2535

chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...

CVE-2011-2535

chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...

PT-2011-3921

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.41.1 Asterisk Open Source versions 1.6.2.x through 1.6.2.18.1 Asterisk Open Source versions 1.8.x through 1.8.4.3 Asterisk Business Edition C.3 through C.3.7.3 Description The issue allows remote...

Multiple vulnerabilities in Winamp 5.61

Luigi Auriemma Application: Winamp http://www.winamp.com Versions: = 5.61 Platforms: Windows Bugs: A vp6 heap corruption B h263 heap corruption C nsvdecvp5 frame heap overflow D nsvdecvp6 frame integer overflow E nsvdecvp3 frame heap overflow F inmod heap corruption Date: 27 Jun 2011 Author: Luig...

Google Releases Chrome 12.0.742.100

Google released Chrome 12.0.742.100 for Windows, Mac, Linux, and Chrome Frame to address a critical vulnerability in the Flash player plug-in. This vulnerability could allow an attacker to take control of the affected system. US-CERT encourages users and administrators to review the Google Chrome...

Google Chrome Releases 12.0.742.91

Google has released Chrome 12.0.742.91 for Windows, Mac, Linux, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Releases blog entry and update to...

frame-oshop SQL injection vulnerability and fix-vulnerability warning-the black bar safety net

frame-oshop is a e-Commerce system, the frame-oshop in the presence ofSQL injectionvulnerabilities that could lead to sensitive information disclosure. +info: frame-oshop SQL Injection Vulnerability product: frame-oshop vendor: http://www.sdaxx.de/ date: 15.05.2011 status: 0day version: i dunno...