Open-Redirect Vulnerability, Fake Government URLs Duping Users

Spammers have recently taken advantage of an open-redirect vulnerability to phish users and trick them into clicking through links that appear to be coming from government .gov URLs. The scam relies on a malformed series of URLs that appear to be coming from 1.USA.gov, a collaboration between...

Truncated dialogs may be used to trick users – Opera Security Advisories

When an important dialog is being displayed, such as a download dialog, the entire dialog should be visible, so that the user can clearly see what the dialog’s buttons will do. In some cases, specific user interactions can cause Opera not to enforce this correctly, allowing the window to become...

Small windows can be used in several ways to trick users into executing downloads – Opera Security Advisories

When the download dialog is displayed, it should always be visible to the user, to ensure that the user realizes it is there. If the dialog is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can end...

Overlapping content can trick users into executing downloads – Opera Security Advisories

Dialogs such as the download dialog are usually displayed on top of page content, to ensure that the user knows that the dialog is requesting attention. In some cases, this policy was not implemented correctly in Opera, allowing certain page content to overlay the dialog. In these cases, clicking...

Hacking a Facebook Account using Facebook

Hacking a Facebook Account using Facebook Many of us know that phishing is also a trick to hack a facebook and session hijicking but hacker can do both at a same time. This vulnerability was happened on Facebook static FBML .Example here . Here you can get that Facebook FBML script : What user wi...

flash-plugin: multiple security flaws (APSB10-16)

Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to trick a user into 1 selecting a link or 2 completing a dialog, related to a "click-jacking" issue...

Firefox 3.0.14 Insufficient warning for PKCS11 module installation and removal

Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the 1 pkcs11.addmodule and 2 pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module...

Opera Web浏览器9.52版本修复多个安全漏洞

BUGTRAQ ID: 30768 Opera是一款流行的WEB浏览器，支持多种平台。 Opera的9.52之前版本中存在多个安全漏洞，可能允许恶意用户执行欺骗和跨站脚本、泄露敏感信息或完全入侵用户系统。 1 当Opera作为协议处理器执行时存在错误，可能导致崩溃或执行任意代码。这个漏洞仅影响Windows平台上的Opera。 2 网页可以更改弹出窗口中打开的其他站点帧的地址，这可能导致向可信任站点帧中加载恶意内容。 3 处理自定义快捷方式和菜单命令时存在错误，允许以危险的参数执行应用程序。成功利用这个漏洞要求能够诱骗用户修改快捷方式或菜单文件。 4...

security flaw

Firefox before 1.0.1 allows remote attackers to spoof the 1 security and 2 download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."...

CVE-2005-0591

Firefox before 1.0.1 allows remote attackers to spoof the 1 security and 2 download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."...

Phishing attack possible with a delayed JavaScript prompt

A malicious page can be crafted to send the userto his banking site, and shortly afterwardsdisplay a dialog enticing the user to type inhis bank login credentials.The dialog will appear in front of the bankingpage, while the window it really belongs to willbe hidden. If the timing and context is...

MS04-024: Buffer overrun in Windows Shell (839645)

The remote host is running a version of Windows that has a flaw in its shell. An attacker could persuade a user on the remote host to execute a rogue program by using a CLSID instead of a file type, thus fooling the user into thinking that he will not execute an application but simply open a...

Netscape Navigator 7.1 - Embedded Image URI Obfuscation

source: https://www.securityfocus.com/bid/10389/info It is reported that Netscape Navigator is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag. This weakness could be employed to...

KDE Konqueror 3.x - Embedded Image URI Obfuscation

KDE Konqueror 3.x - Embedded Image URI Obfuscation source: https://www.securityfocus.com/bid/10383/info It is reported that KDE Konqueror is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted...

Microsoft Outlook Express 6.0 - URI Obfuscation

source: https://www.securityfocus.com/bid/10345/info Microsoft Outlook Express has been reported prone to a URI obfuscation vulnerability. This issue is reported to affect version 6.0 of the affected software, other versions might also be affected. An attacker could reportedly get a user to visit...

Microsoft Internet Explorer 456 - Embedded Image URI Obfuscation

Microsoft Internet Explorer 456 - Embedded Image URI Obfuscation source: https://www.securityfocus.com/bid/10308/info It has been reported that Microsoft Internet Explorer is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is...

Microsoft Internet Explorer 4/5/6 - Embedded Image URI Obfuscation

source: https://www.securityfocus.com/bid/10308/info It has been reported that Microsoft Internet Explorer is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag. This weakness could be...

Qualcomm Eudora 6.0.1/6.1.1 - Attachment LaunchProtect Warning Bypass (2)

source: https://www.securityfocus.com/bid/9101/info A problem has been identified in the implementation of LaunchProtect within Eudora. Because of this, it may be possible to trick users into performing dangerous actions. May 21, 2004 - Eudora version 6.1.1 has been released, however, it is...

[SECURITY] [DSA-380-1] New xfree86 packages fix multiple vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 380-1 [email protected] http://www.debian.org/security/ Matt Zimmerman September 12th, 2003 http://www.debian.org/security/faq -...

Qualcomm Eudora 56 - File Attachment Spoofing (2)

Qualcomm Eudora 56 - File Attachment Spoofing 2 source: https://www.securityfocus.com/bid/5432/info Eudora is reported to be prone to an issue which may allow attackers to spoof the file extension in an attachment. This may aid an attacker in enticing a user of the e-mail client into executing...