security flaw

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by...

security flaw

Firefox before 1.0 and Mozilla before 1.7.5 allows inactive background tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."...

security flaw

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolli...

Java Web Start argument injection vulnerability

OVERVIEW ======== Java Web Start is a technology for easy client-side deployment of Java applications. "Using Java Web Start technology, standalone Java software applications can be deployed with a single click over the network" from Sun Microsystems's website. Java Web Start is installed with Ja...

security flaw

The International Domain Name IDN support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which...

SSL "secure site" indicator spoofing — Mozilla

Various schemes were reported that could cause the "secure site" lock icon to appear and show certificate details for the wrong site. These could be used by phishers to make their spoofs look more legitimate, particularly in windows that hide the address bar showing the true location...

MercuryBoard Forum 1.01.1 - Cross-Site Scripting

MercuryBoard Forum 1.01.1 - Cross-Site Scripting source: https://www.securityfocus.com/bid/12578/info A remote cross-site scripting vulnerability affects the 'forum.php' script of MercuryBoard. This issue is due to a failure of the application to properly sanitize user-supplied input prior to...

Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation

Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation source: https://www.securityfocus.com/bid/12541/info Microsoft Internet Explorer is reported prone to a URI obfuscation weakness. The issue presents itself when a HREF tag contains certain mouse events. This issue may be...

Browser responds to proxy auth request from non-proxy server (ssl/https) — Mozilla

If a proxy is configured the browser would respond to a 407 proxy auth request from any SSL-connected server rather than only responding to the configured proxy server. This could leak NTLM or SPNEGO credentials outside the organization...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:160)

A vulnerability in the Konqueror web browser was discovered that would allow a malicious web site to take advantage of a flaw in kioftp to send email messages without user interaction. The updated packages are patched to correct the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Mozilla Browser <= 1.7.3 NNTP Code Heap Overflow (PoC)

Exploit for unknown platform in category dos / poc ====================================================== Mozilla Browser i = "news://news.individual.net/AAAAAAAAAAAAAA?"; forl = 0; l 0day.today 2018-02-09...

Mozilla Camino Web Browser 0.7/0.8 - Infinite Array Sort Denial of Service

source: https://www.securityfocus.com/bid/11761/info Mozilla Camino Web browser is prone to a vulnerability that may result in a browser crash. This issue is exposed when the browser performs an infinite JavaScript array sort operation. It is conjectured that this will only result in a denial of...

Opera < 7.54 Empty Embedded Object DoS

The version of Opera installed on the remote host contains a flaw that allows an attacker to crash this browser remotely. To exploit this flaw, an attacker would need to craft a rogue website containing an embedded 'CCCC' object with an empty 'src' tag in it and would need to lure a victim to vis...

Opera Web Browser 7.23 - Empty Embedded Object JavaScript Denial of Service

Opera Web Browser 7.23 - Empty Embedded Object JavaScript Denial of Service source: https://www.securityfocus.com/bid/11090/info Opera is a web browser available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS. Opera Web Browser is reported to be...

Microsoft Internet Explorer 6.0 / Firefox 0.8/0.9.x - JavaScript Denial of Service

source: https://www.securityfocus.com/bid/10998/info Web browsers from various vendors are reported prone to a JavaScript denial-of-service vulnerability. The specified JavaScript code will consume 100% of the CPU resources of the affected computer, crashing the browser. Mozilla Firefox, Microsof...

Opera < 7.50 File Download Extension Spoofing

The version of Opera installed on the remote host contains a flaw that may allow a malicious user to trick a user into running arbitrary code. The issue is triggered when an malicious website provides a file for download, but crafts the filename in such a way that the file is executed, rather tha...

Opera < 7.50 onUnload Address Bar Spoofing

The remote host is using Opera - an alternative web browser. This version of Opera is vulnerable to a security weakness that may permit malicious web pages to spoof address bar information. This is reportedly possible through malicious use of the JavaScript 'unOnload' event handler when the brows...

CVE-2004-0537

Opera 7.50 and earlier allows remote web sites to provide a "Shortcut Icon" favicon that is wider than expected, which could allow the web sites to spoof a trusted domain and facilitate phishing attacks using a wide icon and extra spaces...

Mozilla / Firefox user interface spoofing vulnerability

The Mozilla project's family of browsers contain a design flaw that can allow a website to spoof almost perfectly any part of the Mozilla user interface, including spoofing web sites for phishing or internal elements such as the "Master Password" dialog box. This achieved by manipulating "chrome"...

Mozilla 1.7 - External Protocol Handler

source: https://www.securityfocus.com/bid/10681/info Mozilla Internet Browser is reported prone to a weakness that may permit an external protocol to be called without any user interaction. This may expose Mozilla users to vulnerabilities that exist in the underlying operating system or in the...