Netscape Navigator 4.0.8 - about: Domain Information Disclosure

Netscape Navigator 4.0.8 - about: Domain Information Disclosure source: https://www.securityfocus.com/bid/2637/info Due to a flaw in Navigator's security code, all URLs in the about: protocol are considered to be part of the same domain. If arbitrary Javascript code is placed in a GIF's comment...

Netscape Navigator 4.0.8 - 'about:' Domain Information Disclosure

source: https://www.securityfocus.com/bid/2637/info Due to a flaw in Navigator's security code, all URLs in the about: protocol are considered to be part of the same domain. If arbitrary Javascript code is placed in a GIF's comment field, it is treated like a normal HTML page. The Javascript code...

CVE-2000-0676

CVE-2000-0676 affects Netscape Communicator/Navigator 4.04–4.74. An unsigned Java applet could read local files (e.g., file://) and connect to remote resources via file/http/https/ftp URLs, enabling data exfiltration via Brown Orifice. Root cause is an implementation error in the JRE bundled with...

Netscape Navigator buffer overflow

Haven't seen bugreport on it, so I decided to publish this vulnerability. In fact it's pretty old, but still unpublished: Netscape Navigator is vulnerable to trivial, remote buffer overflow attack when viewing prepared html: form action=something method=something input type=password...

netscape.overflow.txt

----- Forwarded message from Michal Zalewski ----- Approved-By: [email protected] Delivered-To: [email protected] Delivered-To: [email protected] X-Hate: Where do you want to go to die? Date: Thu, 28 Sep 2000 18:45:41 +0200 Reply-To: Michal Zalewski From: Michal...

[SECURITY] New version of Netscape Communicator/Navigator released

---------------------------------------------------------------------------- Debian Security Advisory [email protected] http://www.debian.org/security/ Michael Stone September 1, 2000 - ---------------------------------------------------------------------------- Package: netscape communicator,...

JDK 1.1.x Listening Socket Vulnerability (was Re: BrownOrifice can break firewalls!)

On Sat, 12 Aug 2000 05:33:29 +0900 "TAKAGI, Hiromitsu" [email protected] wrote: This can be verified by trying the following refined proof of concept Applet. http://java-house.etl.go.jp/takagi/java/test/Brumleve-BrownOrifice-modified-netscape.net.URLConnection/Test.html I have confirmed that Mac O...

bohttpd.vulnerability.txt

===================================================== Brown Orifice HTTPD Directory Traversal Vulnerability ===================================================== Background ---------- Brown Orifice HTTPD BOHTTPD is "a web server and file sharing tool" that runs as a Java Applet in Netscape...

Internet Security Systems Security Alert: Brown Orifice, BOHTTPD, a Platform Independent Java Vulnerability in Netscape

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Alert August 7, 2000 Brown Orifice, BOHTTPD, a Platform Independent Java Vulnerability in Netscape Synopsis: On August 5th, code was made public by Dan Brumleve, which demonstrates a serious security hole in the Netscape Java...

CVE-2000-0406

The CVE-2000-0406 entry describes: Netscape Communicator before 4.73 and Navigator 4.07 do not properly validate SSL certificates, enabling remote attackers to redirect traffic to a malicious server (Acros-Suencksen SSL) and potentially steal data. No remediation or exploit details are provided i...

CVE-1999-0142

The CVE-1999-0142 issue concerns the Java Applet Security Manager in Netscape Navigator 2.0 and Java Developer’s Kit 1.0, where an applet could connect to arbitrary hosts due to how the security manager operates. Affected software/components are the Java Applet Security Manager implementation wit...

CVE-1999-0142

The Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts...

Advisory CA-2000-08

CERT Advisory CA-2000-08 Inconsistent Warning Messages in Netscape Navigator Original release date: May 26, 2000 Last Revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected Systems running Netscape Navigator, up to and including Navigator 4.73, withou...

ACROS-2000-04-06-1-PUB

=====BEGIN-ACROS-REPORT===== ========================================================================= ACROS Security Problem Report 2000-04-06-1-PUB ------------------------------------------------------------------------- Bypassing Warnings For Invalid SSL Certificates In Netscape Navigator...

Advisory CA-2000-05

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2000-05 Netscape Navigator Improperly Validates SSL Sessions Original release date: May 12, 2000 Source: ACROS, CERT/CC A complete revision history is at the end of this file. Systems Affected Systems running Netscape Navigator 4.72, 4.61, and...

CVE-1999-1002

CVE-1999-1002 affects Netscape Navigator: weak encryption used to store a user's Netscape mail password, leading to partial confidentiality impact. The CVSS base score is 5.0 (MEDIUM) with network attack vector and no authentication required; exploitation details are not provided in the linked do...

CVE-1999-0537

A configuration in a web browser such as Internet Explorer or Netscape Navigator allows execution of active content such as ActiveX, Java, Javascript, etc...

CVE-1999-1002

Netscape Navigator uses weak encryption for storing a user's Netscape mail password...

CVE-1999-1002

Netscape Navigator uses weak encryption for storing a user's Netscape mail password...

netscape.4.x.java.txt

Netscape 4.x javascript security flaw Versions tested: Windows98/Netscape4.7,Windows95/Netscape4.05 Description: Credits to Henri Torgemane Netscape has a "persistent" navigator object, which means that any data put in the window.navigator object will be accessible to every other window as long a...