Design/Logic Flaw

sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...

CVE-2007-3149

sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...

Microsoft Internet Explorer cross-domain frame race condition

Overview Microsoft Internet Explorer contains a race condition that results in a cross-domain violation. Description Internet Explorer uses a cross-domain security model to maintain separation between browser frames from different sources. This model is designed to prevent code in one domain from...

SOL6999 - Web browser domain-based security and discussion of "double eval()" and FP_DO_NOT_TOUCH tags - VU#261869

This potential vulnerability is discussed in the Web browser domain-based security section of this advisory. Additionally, the January 2007 security advisory 1 discusses a potential FirePass cross-site scripting vulnerability related to the double eval Javascript and FPDONOTTOUCH tags. This...

Debian DSA-1210-1 : mozilla-firefox - several vulnerabilities

Several security related problems have been discovered in Mozilla and derived products such as Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-2788 Fernando Ribeiro discovered that a vulnerability in the getRawDER function...

[SECURITY] [DSA 1210-1] New Mozilla Firefox packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1210-1 [email protected] http://www.debian.org/security/ Martin Schulze November 14th, 2006 http://www.debian.org/security/faq -...

DSA-1210 mozilla-firefox

Bulletin has no description...

WMI Object Broker ActiveX Control bypasses ActiveX security model

Overview The Microsoft WMI Object Broker ActiveX control bypasses the ActiveX security model, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description ActiveXActiveX is a technology that allows programmers to create reusable software...

Debian DSA-1191-1 : mozilla-thunderbird - several vulnerabilities

Several security related problems have been discovered in Mozilla and derived products such as Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-2788 Fernando Ribeiro discovered that a vulnerability in the getRawDER functio...

Debian DSA-1192-1 : mozilla - several vulnerabilities

Several security related problems have been discovered in Mozilla and derived products such as Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-2788 Fernando Ribeiro discovered that a vulnerability in the getRawDER functio...

DSA-1192-1 mozilla

Bulletin has no description...

[SECURITY] [DSA 1191-1] New Mozilla Thunderbird packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1191-1 [email protected] http://www.debian.org/security/ Martin Schulze October 5th, 2006 http://www.debian.org/security/faq -...

CVE-2006-4568

Technical details about CVE-2006-4568 are not publicly provided in the connected documents. Monitor for updates from vendors/security advisories.

CVE-2006-4568

Mozilla Firefox before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to bypass the security model and inject content into the sub-frame of another site via targetWindow.framesn.document.open, which facilitates spoofing and other attacks...

JVN#13947696 Ruby contains a vulnerability that prevents safe level 4 from functioning as a sandbox.

Impact An attacker may be able to bypass the security model of a server application and change the status of a untained object. Solution Products Affected Ruby 1.8.4-20060516 and earlier Snapshot versions As a workaround, we recommend that users update to the latest Ruby 1.8.4 snapshot version...

[Full-disclosure] Internet Explorer User Interface Races, Redeux

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Microsoft Internet Explorer User Interface Race Condition I. SYNOPSIS Affected Systems: Windows 98 Windows 98 Second Edition Windows Millennium Edition Windows 2000 Windows XP Windows Server 2003 Risk: Medium Impact: Remote code execution some...

RDS.Dataspace ActiveX control bypasses ActiveX security model

Overview The Microsoft RDS.Dataspace ActiveX control bypasses the ActiveX security model, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description ActiveX ActiveX is a technology that allows programmers to create reusable software components...

[Full-disclosure] Advisory 06/2005: Geeklog SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Geeklog SQL Injection Vulnerability Release Date: 2005/07/05 Last Modified: 2005/07/05 Author: Stefan Esser [email protected] Application: Geeklog = 1.3.11 Severity: An...

CVE-2003-1123

Sun Java Runtime Environment JRE and SDK 1.4.001 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model...

Microsoft Windows HTML Help ActiveX control does not adequately validate window source

Overview The Microsoft Windows HTML Help ActiveX control contains a cross-domain vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands or code with the privileges of the user running the control. The HTML Help control can be instantiated by an HTML...