Browser Navigation Download Trick

No description provided by source. Another moderately interesting tidbit, I guess... It is an important and little-known property of web browsers that one document can always navigate other, non-same-origin windows to arbitrary URLs. Perhaps more interestingly, you can also navigate third-party...

MozillaThunderbird,seamonkey (important)

Mozilla Thunderbird was updated to 24.4.0. Mozilla SeaMonkey was updated to 2.25. MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous memory safety hazards MFSA 2014-17/CVE-2014-1497 bmo966311 Out of bounds read during WAV file decoding MFSA 2014-18/CVE-2014-1498 bmo935618...

Threat Outbreak Alert: Fake Product Purchase Order Request Email Messages on April 8, 2014

Medium Alert ID: 33712 First Published: 2014 April 9 13:11 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product purchase request for the recipient. The text in the email message attempts to convince the recipient to...

MS-DOS: Hack administrator password even if you are a guest

Step1:Go to command prompt Step2:Type "net user" Step3:Find the administrator name which you would like to change the password Step4:Type " net user" space "administrator name" space Step5:It will ask you to change the password Step6:Type the password and confirm it...

CVE-2014-1499

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC 1 camera or 2 microphone permission prompt by triggering navigation at a certain time during generation of this prompt...

Code injection

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC 1 camera or 2 microphone permission prompt by triggering navigation at a certain time during generation of this prompt...

CVE-2014-1499

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC 1 camera or 2 microphone permission prompt by triggering navigation at a certain time during generation of this prompt...

CVE-2014-1499

CVE-2014-1499 affects Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25. The issue lets a remote attacker spoof the domain in the WebRTC camera or microphone permission prompts by triggering a navigation at a specific moment during prompt generation. This is caused by how the browser hand...

Spoofing attack on WebRTC permission prompt — Mozilla

Mozilla developer Ehsan Akhgari reported a spoofing attack where the permission prompt for a WebRTC session can appear to be from a different site than its actual originating site if a timed navigation occurs during the prompt generation. This allows an attacker to potentially gain access to the...

Safari User-Assisted Download and Run Attack

This module abuses some Safari functionality to force the download of a zipped .app OSX application containing our payload. The app is then invoked using a custom URL scheme. At this point, the user is presented with Gatekeeper's prompt: "APPNAME" is an application downloaded from the internet. A...

Safari User-Assisted Download / Run Attack

This Metasploit module abuses some Safari functionality to force the download of a zipped .app OSX application containing our payload. The app is then invoked using a custom URL scheme. At this point, the user is presented with Gatekeeper's prompt: "APPNAME" is an application downloaded from the...

Microsoft Internet Explorer内存破坏漏洞(MS14-010)

CVECAN ID:...

Google Chrome added pop-up warning to prevent users from Browser hijacking

GOOGLE, one of the most trusted brands continuously trying to keep its products more robust and secure for keeping its users safe. Google honors vulnerability hunters under its Bug bounty program and not only that, the company also offer a huge amount of reward to hackers in 'Pwnium' hacking...

Design/Logic Flaw

The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a command prompt...

CVE-2013-2747

The CVE-2013-2747 affects Courion Access Risk Management Suite (Version 8 Update 9). The password reset feature allows remote authenticated users to bypass Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a comman...

SimplyShare 1.4 Code Execution / Local File Inclusion / XSS

Document Title: =============== SimplyShare v1.4 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1181 Release Date: ============= 2014-01-28 Vulnerability Laboratory ID VL-ID: ==================================== 1181...

Hiox Guest Book 5.0 Cross Site Scripting

Exploit Title : HIOX GUEST BOOK 5.0 HGB-5.0 Cross Site Scripting Author : JoKeRStEx Tested On : Windows Download Software Link : www.hscripts.com/scripts/php/downloads/HGB.zip Date : 03/01/2014 + P.O.C prompt'JoKeRStEx'" prompt'xss email'" prompt'xss comment'" + For test The Exploit Example...

Firefox XPCOM Execute Command

This module runs a shell command on the target OS without touching the disk. On Windows, this command will flash the command prompt momentarily. This can be avoided by setting WSCRIPT to true, which drops a jscript "launcher" to disk that hides the prompt. This module requires Metasploit:...

Breach incident

News Breach incident Share December 11th, 2013 At Opera, we strive to be open, and we want to continue this tradition, by sharing with you what happens here. High profile companies like Opera are under continuous attack by hackers trying to break into their systems, and we want to tell you about ...

Byword 2.x File Overwrite Vulnerability

The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to overwrite arbitrary files via the name and text parameters in a byword://replace URL. Affected Vendor: http://metaclassy.com/ - Affected Software: Byword for iO...