CVE-2006-4092

Simpliciti Locked Browser does not properly limit a user's actions to ones within the intended Internet Explorer environment, which allows local users to perform unauthorized actions by visiting a web site that executes a JavaScript window.blur loop to remove focus from the browser window, then...

vulnerabilities: CVE-2006-{3113,3677,3801-3812}

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and possibly load chrome: URLs by tricking the user into copying or dragging links...

msie-heap.txt

// MoBB Demonstration function Demo var a = new ActiveXObject"Internet.HHCtrl.1"; var b = unescape"XXXX"; while b.length Clicking the button below may crash your browser!...

Chipmunk 1.4 - 'Guestbook index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18118/info Chipmunk Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

IntelliLink Pro 5.06 - 'addlink_lwp.cgi?url' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17605/info IntelliLink Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execut...

security flaw

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by...

security flaw

Firefox before 1.0 and Mozilla before 1.7.5 allows inactive background tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."...

security flaw

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolli...

Java Web Start argument injection vulnerability

OVERVIEW ======== Java Web Start is a technology for easy client-side deployment of Java applications. "Using Java Web Start technology, standalone Java software applications can be deployed with a single click over the network" from Sun Microsystems's website. Java Web Start is installed with Ja...

security flaw

The International Domain Name IDN support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which...

SSL "secure site" indicator spoofing — Mozilla

Various schemes were reported that could cause the "secure site" lock icon to appear and show certificate details for the wrong site. These could be used by phishers to make their spoofs look more legitimate, particularly in windows that hide the address bar showing the true location...

MercuryBoard Forum 1.01.1 - Cross-Site Scripting

MercuryBoard Forum 1.01.1 - Cross-Site Scripting source: https://www.securityfocus.com/bid/12578/info A remote cross-site scripting vulnerability affects the 'forum.php' script of MercuryBoard. This issue is due to a failure of the application to properly sanitize user-supplied input prior to...

Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation

Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation source: https://www.securityfocus.com/bid/12541/info Microsoft Internet Explorer is reported prone to a URI obfuscation weakness. The issue presents itself when a HREF tag contains certain mouse events. This issue may be...

Browser responds to proxy auth request from non-proxy server (ssl/https) — Mozilla

If a proxy is configured the browser would respond to a 407 proxy auth request from any SSL-connected server rather than only responding to the configured proxy server. This could leak NTLM or SPNEGO credentials outside the organization...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:160)

A vulnerability in the Konqueror web browser was discovered that would allow a malicious web site to take advantage of a flaw in kioftp to send email messages without user interaction. The updated packages are patched to correct the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Mozilla Browser <= 1.7.3 NNTP Code Heap Overflow (PoC)

Exploit for unknown platform in category dos / poc ====================================================== Mozilla Browser i = "news://news.individual.net/AAAAAAAAAAAAAA?"; forl = 0; l 0day.today 2018-02-09...

Mozilla Camino Web Browser 0.7/0.8 - Infinite Array Sort Denial of Service

source: https://www.securityfocus.com/bid/11761/info Mozilla Camino Web browser is prone to a vulnerability that may result in a browser crash. This issue is exposed when the browser performs an infinite JavaScript array sort operation. It is conjectured that this will only result in a denial of...

Opera < 7.54 Empty Embedded Object DoS

The version of Opera installed on the remote host contains a flaw that allows an attacker to crash this browser remotely. To exploit this flaw, an attacker would need to craft a rogue website containing an embedded 'CCCC' object with an empty 'src' tag in it and would need to lure a victim to vis...

Opera Web Browser 7.23 - Empty Embedded Object JavaScript Denial of Service

Opera Web Browser 7.23 - Empty Embedded Object JavaScript Denial of Service source: https://www.securityfocus.com/bid/11090/info Opera is a web browser available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS. Opera Web Browser is reported to be...

Microsoft Internet Explorer 6.0 / Firefox 0.8/0.9.x - JavaScript Denial of Service

source: https://www.securityfocus.com/bid/10998/info Web browsers from various vendors are reported prone to a JavaScript denial-of-service vulnerability. The specified JavaScript code will consume 100% of the CPU resources of the affected computer, crashing the browser. Mozilla Firefox, Microsof...