Stable Channel Update

The Chrome team is excited to announce the promotion of Chrome 25 to the Stable Channel. Chrome 25.0.1364.97 for Windows and Linux, and 25.0.1364.99 for Mac contain a number of new items including: Improvements in managing and securing your extensions Better support for HTML5 time/date inputs...

Samsung's new OS Tizen 2.0 source code released

The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it's designed to run apps written using web technologies...

Samsung's new OS Tizen 2.0 source code released

The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it’s designed to run apps written using web technologies...

Specially crafted WebP images can be used to disclose random chunks of memory

WebP images may be used as fill patterns in a HTML5 Canvas, and the values of each pixel in the image can then be intentionally read using scripts. Specially crafted WebP images may specify the wrong size for certain parts of their data, which causes Opera to read data from the wrong positions in...

Internet shortcuts used for phishing in <img> elements

Websites may occasionally want to display image content from untrusted sources. A phishing attack may be carried out by the untrusted source, by displaying malicious instructions on the image, or by navigating the containing page to a similar looking document on another server. Since some image...

Firefox 16.0.2 available, Cross site scripting attack patched

16.0.2 Firefox is now available for anyone who wants to try before anyone else. Mozilla address one serious vulnerability. According to the information security of Mozilla, they has fixed a number of issues related to the Location object in order to enhance overall security. The Location object i...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8327)

MozillaFirefox was updated to the 10.0.9ESR security release which fixes bugs and security issues : - Security researchers Thai Duong and Juliano Rizzo reported that SPDY's request header compression leads to information leakage, which can allow the extraction of private data such as session...

Mozilla Firefox Multiple Vulnerabilities - Oct 12 (Windows)

The host is installed with Mozilla Firefox and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmozillaprdtsmultvulnoct12win.nasl 5931 2017-04-11 09:02:04Z teissa $ Mozilla Firefox Multiple Vulnerabilities - Oct 12 Windows Authors: Madhuri D Copyright: Copyright c 2012...

Mozilla Firefox Multiple Vulnerabilities - Oct 12 (Mac OS X)

The host is installed with Mozilla Firefox and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmozillaprdtsmultvulnoct12macosx.nasl 5999 2017-04-21 09:02:32Z teissa $ Mozilla Firefox Multiple Vulnerabilities - Oct 12 Mac OS X Authors: Madhuri D Copyright: Copyright c 2012...

Advance Phishing Attacks using HTML5 Fullscreen API

Do your ever use YouTube Instant Search engine a really fast way to search YouTube ? That was developed by a 21 years old developer name - Feross Aboukhadijeh in 2012. Chad Hurley, CEO and co-founder of YouTube, was so impressed that he immediately offered him a job at YouTube. He a web developer...

USN-1611-1: Thunderbird vulnerabilities

Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Thunderbird. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit these to execute arbitrary JavaScript code within the...

CVE-2012-3985

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting XSS attacks by leveraging initial-origin access after document.domain has been set...

Cross site scripting

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting XSS attacks by leveraging initial-origin access after document.domain has been set...

CVE-2012-3985

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting XSS attacks by leveraging initial-origin access after document.domain has been set...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

Proof-of-Concept Exploits HTML5 Fullscreen API for Social Engineering

Independent security researcher, web designer, and Stanford Computer Science student Feross Aboukhadijeh has developed an attack concept that exploits the fullscreen application programming interface in HTML5 in order to carry out phishing attacks. The attack leverages the ‘fullscreen API’ featur...

CVE-2012-3985

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting XSS attacks by leveraging initial-origin access after document.domain has been set...

Continued access to initial origin after setting document.domain — Mozilla

Security researcher Collin Jackson reported a violation of the HTML5 specifications for document.domain behavior. Specified behavior requires pages to only have access to windows in a new document.domain but the observed violation allowed pages to retain access to windows from the page's initial...

CVE-2012-4415: guacamole local root vulnerability

Overview ======== "Guacamole is an HTML5 web application that provides access to desktop environments using remote desktop protocols such as VNC or RDP. A centralized server acts as a tunnel and proxy, allowing access to multiple desktops through a web browser. No plugins are needed: the client...

Unfixed XSS vulnerability at www.jeux-html5.net

Security researcher Atmon3r, has submitted on 10/01/2012 a cross-site-scripting XSS vulnerability affecting www.jeux-html5.net, which at the time of submission ranked 17261575 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/01/2012. It is...