CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

[pdf] Attacking with HTML5

Attacking with HTML5 December 16, 2010 Presentation White paper...

Apple Safari Directory Traversal

CVE: CVE-2011-3229 Found by: Aaron Sigel of vtty.com Summary: Safari is vulnerable to a directory traversal issue with the handling of "safari-extension://" URLs. Attackers can create malicious websites that trigger Safari to send files from the victim's system to the attacker. Arbitrary Javascri...

GateOne Beta - Terminal emulator for HTML5 web browsers

GateOne Beta - Terminal emulator for HTML5 web browsers The software makes use of WebSockets to connect a server backend written in Python and a frontend written for modern browsers in JavaScript, HTML5 and CSS. The frontend doesn't require any browser plug-ins to be installed.Gate One also...

Evercookie Creator: FTC Cookie Inquiry Would Be Too Narrow

Samy Kamkar has always been prescient. He first gained notoriety by showing how nascent social networks like MySpace could be used to spread malware rapidly among a population of millions now billions of users. His worm for MySpace, dubbed the ‘Samy Worm’ earned him a visit from law enforcement...

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Apple Safari Update Fixes 58 Bugs, Adds Sandboxing

Along with the release of their new Lion OS X, Apple has issued a new version of its Safari browser for Mac and Windows users, pushing version 5.1 and 5.0.6 to patch a boatload of security holes, some of which are critical. Fifty-eight security vulnerabilities in total are addressed in the update...

PT-2011-16: Denial Of Service in Mozilla Firefox

Positive Research Center has discovered a Denial of Service vulnerability in Mozilla Firefox. Due to insufficient checks of input parameters of HTML5 Canvas' Arc method, Mozilla Firefox allows a remote attacker to cause a denial of service infinite loop. Example of HTML code triggering the...

Fedora 13 : python-feedparser-5.0.1-1.fc13 (2011-4911)

Current release: 5.0.1 - February 20, 2011 - Fix issue 91 invalid text in XML declaration causes sanitizer to crash - Fix issue 254 sanitization can be bypassed by malformed XML comments - Fix issue 255 sanitizer doesn't strip unsafe URI schemes Previous release: 5.0 - January 25, 2011 - Improved...

Fedora 14 : python-feedparser-5.0.1-1.fc14 (2011-4894)

Current release: 5.0.1 - February 20, 2011 - Fix issue 91 invalid text in XML declaration causes sanitizer to crash - Fix issue 254 sanitization can be bypassed by malformed XML comments - Fix issue 255 sanitizer doesn't strip unsafe URI schemes Previous release: 5.0 - January 25, 2011 - Improved...

HTML5 Implementation in Chrome, Opera, and Safari Could Allow Information Disclosure

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Google Chrome browser versions 8.0.552.210 and earlier; Opera browser versions 10.62 and earlier; and Safari browser versions 4.1.2 and earlier, Safari browser versions 5.0.2 and...

Fedora 15 : python-feedparser-5.0.1-1.fc15 (2011-4988)

Current release: 5.0.1 - February 20, 2011 - Fix issue 91 invalid text in XML declaration causes sanitizer to crash - Fix issue 254 sanitization can be bypassed by malformed XML comments - Fix issue 255 sanitizer doesn't strip unsafe URI schemes Previous release: 5.0 - January 25, 2011 - Improved...

Apple Safari Webkit Multiple Vulnerabilities (Mar 2011)

Apple Safari web browser is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari";...

CVE-2011-0166

The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778...

CVE-2011-0166

The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778...

Design/Logic Flaw

The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778...

CVE-2011-0166

The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778...

CVE-2011-0166

CVE-2011-0166 applies to WebKit in Apple Safari up to version 5.0.3, where HTML5 drag-and-drop could bypass Same Origin Policy and leak sensitive data. Root cause: drag-and-drop handling in WebKit. Impact: user-assisted remote information disclosure with no explicit exploit details provided. Reme...

Mozilla introduces the "Web Apps" project just before release of release of Firefox 4 final !

Shortly before the release of the final version of Firefox 4, the Mozilla developers have introduced the "Web Apps" project. These apps are expected to play a major role play in future browsers, and in such a future, the browser will not just be for viewing web pages but will be a platform for...