Set your Web browsers to "stun"…it's the online holiday shopping season. Here are ten tips for surviving it without getting yourself p4wn3d

Cyber Monday is billed as the biggest online shopping day of the year, with deep discounts from online merchants. But the truth is that your online shopping isn’t anywhere near done now that its passed, any more than your in store shopping is done now that the 3:00 AM Black Friday door buster...

DEBIAN-CVE-2010-4008

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service application crash via a...

Mozilla Foundation Security Advisory 2010-69

Mozilla Foundation Security Advisory 2010-69 Title: Cross-site information disclosure via modal calls Impact: High Announced: October 19, 2010 Reporter: Eduardo Vela Nava Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.11 Firefox 3.5.14 Thunderbird 3.1.5 Thunderbird 3.0.9 SeaMonke...

JVN#89272705: Sleipnir and Grani may insecurely load executable files

Sleipnir and Grani provided by Fenrir are web browsers. Sleipnir and Grani load certain executables when displaying the source code of the HTML file currently being viewed. Sleipnir and Grani contain an issue with the file search path, which may insecurely load executables. Impact An attacker may...

JVN#50610528: Sleipnir and Grani may insecurely load dynamic libraries

Sleipnir and Grani provided by Fenrir are web browsers. Sleipnir and Grani loads certain DLL's when HTML files are opened. Sleipnir and Grani contain an issue with the DLL search path, which may lead to insecurely loading dynamic libraries. Impact An attacker may execute arbitrary code with the...

Security a Concern as HTML5 Gains Traction

From animated logos to Web videos for hip, independent bands, HTML5 is getting buzz and gaining traction. But concerns about the security of features in the new version of the Web’s lingua franca persist. Every technology innovation has its coming out party, and Google Inc.’s recent “dancing ball...

Multiple Web Browsers Window Injection (CVE-2004-1155)

Most modern web browsers support the Dynamic Hypertext Markup Language DHTML application programming interface API. The DHTML API may be utilized to manipulate HTML objects, events, properties and methods exposed by the DHTML object model. The window object offers several methods to manipulate th...

Default Applications

Under the Programs tab, you can specify your default applications for viewing web sites, email messages, HTML editing and various other network related tasks. You can also disable Internet Explorer from asking you if you would like it to be your default web browser here. See more information on...

Mozilla Plugin Check Now Cross-Browser

Mozilla has expanded its Plugin Check utility to support multiple web browsers. According to Mozilla, a new cross-browser Plugin Check page now works with Firefox, Safari 4, Chrome 4, Opera 10.5 and Internet Explorer 7 and 8 for the most popular plugins but since IE requires specific code to be...

Canvas Tag Denial Of Service

"; while 1 echo ""; echo ""; echo ""; ?...

Oracle Releases Sun Java SE 1.6.0_20

Oracle has released Sun Java SE 1.6.020 to address several vulnerabilities. The release notes for this version of Java SE indicate that these vulnerabilities are in Java Deployment Toolkit and the new Java Plug-in. Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker...

png -- libpng decompression buffer overflow

The PNG project describes the problem in an advisory: Several versions of libpng through 1.4.2 and through 1.2.43 in the older series contain a bug whereby progressive applications such as web browsers or the rpng2 demo app included in libpng could receive an extra row of image data beyond the...

ZDI-10-030: Apple WebKit CSS run-in Attribute Rendering Remote Code Execution Vulnerability

ZDI-10-030: Apple WebKit CSS run-in Attribute Rendering Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-030 March 16, 2010 -- Affected Vendors: Apple Google -- Affected Products: Apple WebKit Apple Safari Google Chrome -- TippingPointTM IPS Customer...

JVN#73331060 tDiary plugin tb-send.rb vulnerable to cross-site scripting

tDiary is a weblog software. tDiary plugin tb-send.rb contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on some web browsers. Solution Update the Software Update according to the information provided by the developer. Products Affected tDiary 2.2.2full set...

CanSecWest Pwn2Own Hacker Contest Targets Smartphones

The organizers of this year’s CanSecWest Pwn2Own have painted a big bulls-eye on mobile devices, offering up an whopping $60,000 in prizes to entice hackers to exploit vulnerabilities on iPhones, Android, Nokia and BlackBerry smartphones. At Pwn2Own 2010, which takes place in Vancouver on March 2...

Adobe Reader Plugin Malformed URL Cross-Site Scripting (APSB07-01; CVE-2007-0045; CVE-2007-0048)

Multiple cross-site scripting XSS vulnerabilities have been discovered in Adobe Reader and Acrobat Plugin when used with various Web browsers. The vulnerabilities are due to an error in the Adobe Acrobat Reader Plugin...

CVE-2009-4197

rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 contains a form that does not disable the autocomplete setting for the password parameter, which makes it easier for local users or physically proximate attackers to obtain the password from web browsers that support...

Web Security Flaws Up 10% in 2009

Almost 80% of more than 3,000 software security flaws publicly reported so far this year have been in Web technologies such as Web servers, applications, plugins and Web browsers. That number is about 10% higher than the number of flaws reported in the same period last year — and nine out of 10 o...

Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass source: https://www.securityfocus.com/bid/35888/info Mozilla Network Security Services NSS is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate,...

Mozilla Releases Preview Builds of Firefox with Content Security Policy

Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks. The CSP specification is Mozilla’s effort to provide Web site operators with a simpler way to...