Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection

Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a l...

JIRA should trust itself by default.

Upgrade Seraph and Trusted apps to 2.0.1/2.1. If the CurrentApplication implements TrustedApplication then return it if it is asked for by id...

JIRA should trust itself by default.

Upgrade Seraph and Trusted apps to 2.0.1/2.1. If the CurrentApplication implements TrustedApplication then return it if it is asked for by id...

Adobe Flash Attacks Underway; Harden PDF Reader Immediately

Malicious hackers have found a new vulnerability in Adobe’s ever-present Flash software and are using rigged PDF documents to launch exploits against Windows targets. The Adobe Flash Player flaw, which is currently unpatched, affects millions of Windows XP and Windows Vista users. Adobe has...

Google Chrome 2.0.172 - 'About:blank' Address Bar URI Spoofing 'About:blank' Address Bar URI Spoofing

source: https://www.securityfocus.com/bid/35839/info Google Chrome is affected by a URI-spoofing vulnerability. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be...

Apple Safari 4.0.1 - Error Page Address Bar URI Spoofing

source: https://www.securityfocus.com/bid/35829/info Apple Safari is affected by a URI-spoofing vulnerability. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be...

One Year Later: Dan Kaminsky on DNS Security Problems

From SearchSecurity Network security researcher Dan Kaminsky has had a year to reflect on the impact of the cache poisoning vulnerability he discovered in the Domain Name System DNS. Kaminsky revealed during last year’s Black Hat Briefings a technique that made it relatively easy to exploit the b...

Mozilla Firefox 3.5.1 - Error Page Address Bar URI Spoofing

Mozilla Firefox 3.5.1 - Error Page Address Bar URI Spoofing source: https://www.securityfocus.com/bid/35803/info Mozilla Firefox is affected by a URI-spoofing vulnerability. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This m...

New fake banking cert attacks in play

From eWEEK Matt Hines Researchers with security training experts SANS Institute have reported the emergence of a new wave of attacks seeking to take advantage of trust in online banking sites and digital certificate e-banking security programs. The involved attacks target customers of Bank of...

Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing

source: https://www.securityfocus.com/bid/35388/info Mozilla Firefox and SeaMonkey are affected by a URI-spoofing vulnerability because they fail to adequately handle user-supplied data. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting...

FreeBSD : Incorrect cross-realm trust handling in Heimdal (bfb36941-84fa-11d8-a41f-0020ed76ef5a)

Heimdal does not correctly validate the transited' field of Kerberos tickets when computing the authentication path. This could allow a rogue KDC with which cross-realm relationships have been established to impersonate any KDC in the authentication path. %NASLMINLEVEL 70300 C Tenable Network...

The Importance of Internet Identity and Anonymity

Last year, Craig Mundie issued a call to arms for a more “trustworthy Internet” — not that Microsoft has been entirely successful at implementing its arguably more humble Trustworthy Computing initiative. But let’s not let the computing industry’s failure to bring forward operating systems, web...

Charney plugs Microsoft end-to-end trust at RSA Conference

Scott Charney used his keynote speech at the RSA Conference on Tuesday to talk up a variety of hardware and software-based technologies meant to infuse the Internet with more trust. Charney, the head of Microsoft’s Trustworthy Computing team, talked about the need for greater adoption of TPMs, co...

Sun Java System Delegated Administrator 6.x - HTTP Response Splitting

source: https://www.securityfocus.com/bid/34643/info Sun Java System Delegated Administrator is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to influence or misrepresent how web content is served,...

Sun Java System Delegated Administrator 6.x - HTTP Response Splitting

Sun Java System Delegated Administrator 6.x - HTTP Response Splitting source: https://www.securityfocus.com/bid/34643/info Sun Java System Delegated Administrator is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can...

Doing business with Heartland; Regaining the trust

By Andrew Storms According to a this news article computerworld.com and a statement by Heartland 2008breach.com, competitors of the now PCI-delisted payment processor are using the breach as means to lure their customers. Competitors are apparently suggesting that doing business with Heartland wi...

Ubuntu Update for mozilla-thunderbird, thunderbird vulnerabilities USN-629-1

Ubuntu Update for Linux kernel vulnerabilities USN-629-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6291.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for mozilla-thunderbird, thunderbird vulnerabilities USN-629-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networ...

Rosoft Media Player 4.2.1 Local Buffer Overflow Exploit (multi target)

Exploit for unknown platform in category local exploits ====================================================================== Rosoft Media Player 4.2.1 Local Buffer Overflow Exploit multi target ====================================================================== / rsmpf.c Rosoft media player...

CentOS Update for firefox CESA-2008:0549 centos3 i386

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2008:0549 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

APC PowerChute Network Shutdown - HTTP Response Splitting / Cross-Site Scripting

source: https://www.securityfocus.com/bid/33924/info APC PowerChute Network Shutdown is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...