Researcher Reveals Major SSL and Browser Flaws

LAS VEGAS–A security researcher has found a slew of fundamental problems with the way that modern browsers are designed and built, leading to serious questions about the security of these applications and the way that they handle SSL sessions. The research, done by Robert Hansen of SecTheory, sho...

Microsoft Access ActiveX Control Multiple Instantiation Remote Code Execution Vulnerability

Description Microsoft Access is prone to a remote code-execution vulnerability that affects ActiveX instantiations. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the...

eliteCMS 1.01 - Multiple Cross-Site Scripting Vulnerabilities

eliteCMS 1.01 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/41537/info eliteCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An...

Joomla! Component Rapid-Recipe - HTML Injection

source: https://www.securityfocus.com/bid/41531/info Joomla! Rapid-Recipe component is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and...

Worxware DCP-Portal 7.0 - Multiple Cross-Site Scripting Vulnerabilities

Worxware DCP-Portal 7.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/41453/info Worxware DCP-Portal is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issu...

NTSOFT BBS E-Market Professional - Multiple Cross-Site Scripting Vulnerabilities (2)

NTSOFT BBS E-Market Professional - Multiple Cross-Site Scripting Vulnerabilities 2 source: https://www.securityfocus.com/bid/41401/info NTSOFT BBS E-Market Professional is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An...

Orbis CMS 1.0.2 - 'editor-body.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/41390/info Orbis CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

Internet Browser Classic (IBC 0-6-1) DOS Exploit

Exploit for windows platform in category dos / poc ================================================ Internet Browser Classic IBC 0-6-1 DOS Exploit ================================================ AUTHOR : Cur53D MAIL : Hyq6xxatgmail.com DATE : 29,june 2010 Blog : www.Cur53D.dlstreet.net Type :...

VideoWhisper PHP 2 Way Video Chat - 'r' Cross-Site Scripting

source: https://www.securityfocus.com/bid/40832/info VideoWhisper PHP 2 Way Video Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the...

Microsoft Help and Support Center 'sysinfo/sysinfomain.htm' Cross Site Scripting Weakness

Description Help and Support Center is prone to a cross-site scripting weakness because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the privileged zone of the browser of an unsuspecting user. NOTE: This issue is a...

Juniper Networks SA2000 SSL VPN Appliance - welcome.cgi Cross-Site Scripting

Juniper Networks SA2000 SSL VPN Appliance - welcome.cgi Cross-Site Scripting source: https://www.securityfocus.com/bid/41664/info Juniper Networks SA2000 SSL VPN appliance is prone to a cross-site scripting vulnerability because the web interface fails to properly sanitize user-supplied input. An...

Microsoft Internet Explorer Developer Toolbar (CVE-2010-1261) Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks may cause denial-of-service conditions. Technologies Affected Avaya Meetin...

Microsoft Internet Explorer Uninitialized Memory (CVE-2010-1259) Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks may cause denial-of-service conditions. Technologies Affected Avaya Meetin...

Microsoft Internet Explorer Developer Toolbar HTML Element Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks may cause denial-of-service conditions. Technologies Affected Avaya Meetin...

Hexjector 1.0.7.2 - 'hexjector.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/40509/info Hexjector is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this issue to execute arbitrary script code in the...

BackLinkSpider 1.3.1774 - Multiple Cross-Site Scripting Vulnerabilities

BackLinkSpider 1.3.1774 Multiple Cross Site Scripting Vulnerabilities. Webapps exploit for php platform source: http://www.securityfocus.com/bid/40400/info BackLinkSpider is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before usi...

PR10-03: Authenticated Cross-Site Scripting (XSS) within the Apache Axis2 administration console

PR10-03: Authenticated XSS within the Apache Axis2 administration console Vulnerability found: 30th January 2010 Vendor informed: 1st February 2010 Vulnerability fixed: Severity: Medium Description: Axis2 is a web services/SOAP/WDSL engine, widely used within many commercial products Procheckup h...

New Tabbed Browsing Phishing Attack Exploits User Trust

A researcher has developed a new type of phishing attack that takes advantage of the way that browsers handle tabbed browsing and enables an attacker to use a script running in one tab to completely change the content in another tab. The attack, demonstrated by Aza Raskin of Mozilla, could be use...

New Phishing Attack Exploits Tabbed Browsing

In this video, Aza Raskin of Mozilla demonstrates a new class of phishing attack in which the attacker is able to use malicious code in one browser tab to completely change the content in another tab on a victim’s browser...

Ruubikcms 1.0.3 - index.php Cross-Site Scripting

Ruubikcms 1.0.3 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/40375/info RuubikCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage thi...