Geek.com Hacked, Infects Visitors with Malware !

Geek.com Hacked, Infects Visitors with Malware ! Security researchers from cloud security provider Zscaler warn that technology website geek.com was compromised and many of its pages are executing drive-by download attacks against visitors. Geek.com is one of the oldest technology news websites...

NoScript可绕过 "Reflective XSS"检测漏洞

NoScript Firefox extension是一款免费的开源插件，提供对Firefox、Seamonkey和其他基于Mozilla浏览器的额外保护。 NoScript的实现上存在漏洞，远程攻击者可利用此漏洞绕过反射式XSS保护。 在通过SQLXSSI发动攻击时，NoScript未能从受信任的域中检测到反射式XSS。通过利用浏览器中的错误信息机制发动Union SQL投毒攻击而导致的“Reflective XSS”可成功地绕过NoScript。 NoScript NoScript 2.0.5.1 NoScript NoScript 2.0.6 厂商补丁： NoScript...

NoScript Cross Site Scripting Via SQL Injection

Hi List NoScript fails to detect the reflective XSS from trusted domains when an attack is conducted through SQLXSSI. The bypass in NoScript has been successfully conducted by using "Reflective XSS" through Union SQL poisoning attacks by exploiting the reverted errors in the browser. The attack...

Mozilla Confirms Critical Firefox Bug, Readies Fix

Mozilla is working on a patch for the recently disclosed critical bug in Firefox that has been exploited on at least one prominent Web site this week. The vulnerability in Firefox is being used by attackers in drive-by download attacks to install malware on victims’ machines. Mozilla’s security...

Firefox 3.5 and 3.6 Vulnerability

Mozilla has released a blog entry indicating that it is aware of a critical vulnerability affecting Firefox 3.5 and Firefox 3.6. This vulnerability may allow an attacker to execute arbitrary code. The blog entry indicates that active exploitation of this vulnerability has been detected. Update: T...

Mozilla Foundation Security Advisory 2010-57

Mozilla Foundation Security Advisory 2010-57 Title: Crash and remote code execution in normalizeDocument Impact: Critical Announced: September 7, 2010 Reporter: regenrecht Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonke...

Firefox + NoScript Configurations

From the NoScript Options screen, select the Embeddings tab to find options for dealing with potentially dangerous objects on untrusted sites. You can also choose to apply these restrictions of whitelisted trusted sites. If this option is too intrusive, it can be turned off at the cost of increas...

Firefox + NoScript

NoScript for Firefox is an open-source add-on that pre-emptively blocks malicious scripts and allows JavaScript, Java and other potentially dangerous content only from sites you trust. Because Firefox does not have easily-configured security zones like Internet Explorer, NoScript is needed to...

Mozilla Packages Firefox Security Suite Add-Ons

Mozilla has packaged a suite of security-centric plugins to help Firefox users stay safe while surfing on the Internet. The package, available here, includes NoScript, Better Privacy, AdBlock Plus and WOT Web of Trust. Mozilla has also expanded its Plugin Check to help users identify and patch...

Mozilla Firefox 3.5 TraceMonkey JavaScript engine uninitialized memory vulnerability

Overview Mozilla Firefox's javascript engine contains a vulnerability that may allow an attacker to execute code. Description Mozilla Firefox version 3.5 contains a vulnerability in the TraceMonkey components of Firefox's JavaScript engine.Per Mozilla Bug Bug 503286: "This is a JS engine bug...

Mozilla Foundation Security Advisory 2009-31

Mozilla Foundation Security Advisory 2009-31 Title: XUL scripts bypass content-policy checks Impact: Low Announced: June 11, 2009 Reporter: Wladimir Palant Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.0.11 Description Mozilla add-on developer and community member Wladimir Palant...

Mozilla Firefox JavaScript engine fails to properly handle garbage collection

Overview Mozilla Firefox JavaScript engine fails to properly handle garbage collection. This vulnerability result in memory corruption, which in some cases may be exploitable to execute arbitrary code. Description Per Mozilla Foundation Security Advisory 2008-20:Fixes for security problems in the...

US-CERT Technical Cyber Security Alert TA08-100A -- Adobe Flash Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-100A Adobe Flash Updates for Multiple Vulnerabilities Original release date: April 9, 2008 Last revised: -- Source: US-CERT Systems Affected Adobe Flash Player 9.0.115.0 and earlier Adobe...

US-CERT Technical Cyber Security Alert TA08-087A -- Mozilla Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-087A Mozilla Updates for Multiple Vulnerabilities Original release date: March 27, 2008 Last revised: -- Source: US-CERT Systems Affected Mozilla Firefox Mozilla Thunderbird Mozilla...

Adobe Flash Player may load arbitrary, malformed cross-domain policy files

Overview Adobe Flash Player may load arbitrary, malformed cross-domain policy files. This could allow an attacker to control cross-domain data loading, potentially allowing the attacker to gain access to sensitive information or to manipulate content in other domains. Description Adobe Flash Play...

Mozilla browsers fail to properly handle images

Overview A vulnerability exists in Mozilla products that may allow a remote attacker to view browser history or cause a denial of service. Description Mozilla products contain a vulnerability in the browser engine that may result in information disclosure or a denial of service when handling...

UPnP enabled by default in multiple devices

Overview Multiple vendors ship devices with UPnP enabled by default. By convincing a user to open a malicious URL, an attacker may be able to remotely control or configure UPnP enabled devices. Description Universal Plug and Play UPnP is a collection of protocols maintained and distributed by the...

Mozilla-based browsers jar: URI cross-site scripting vulnerability

Overview Mozilla-based web browsers including Firefox contain a vulnerability that may allow an attacker to execute code, or conduct cross-site scripting attacks. Description The jar: protocol is designed to extract content from ZIP compressed files. Mozilla-based browsers include support for jar...

Google Gmail cross-site request forgery vulnerability

Overview According to public reports, Google Gmail contained a cross-site request forgery XSRF vulnerability that allowed attackers to create email filters that could forward mail and attachments to arbitrary email addresses. Description Google Gmail is a web-based mail service. Gmail provides...

Pluxml 0.3.1 Remote Code Execution Exploit

?php This file require the PhpSploit class. If you want to use this class, the latest version can be downloaded from acid-root.new.fr. Note: The new version is compatible with PHP 4 by default. errorreportingEALL ^ ENOTICE; require'phpsploitclass.php'; C: sploit.php -url...