Multiple Browsers - Audio Tag Denial of Service

Multiple Browsers - Audio Tag Denial of Service !/usr/bin/python Multiple Browsers Audio Tag Denial of Service Vulnerability any ogg file can be used for the DoS as long as it is a valid file on the server crash reporter for Mac seems to think this is a EXECBADACCESS This script acts as a web...

Multiple Browsers Audio Tag DoS Vulnerability

Exploit for multiple platform in category dos / poc ============================================= Multiple Browsers Audio Tag DoS Vulnerability ============================================= !/usr/bin/python Multiple Browsers Audio Tag Denial of Service Vulnerability any ogg file can be used for t...

Multiple Browsers - Audio Tag Denial of Service

!/usr/bin/python Multiple Browsers Audio Tag Denial of Service Vulnerability any ogg file can be used for the DoS as long as it is a valid file on the server crash reporter for Mac seems to think this is a EXECBADACCESS This script acts as a web server to DoS connecting clients Exploit Title:...

Oracle Releases Sun Java SE 1.6.0_20

Oracle has released Sun Java SE 1.6.020 to address several vulnerabilities. The release notes for this version of Java SE indicate that these vulnerabilities are in Java Deployment Toolkit and the new Java Plug-in. Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker...

New Clickjacking Techniques to Be Revealed

At Black Hat Europe a researcher will demonstrate a new, powerful breed of clickjacking attacks he devised that can bypass newly constructed defenses in browsers and Websites. Read the full article. Dark Readiing...

Serious New Java Flaw Affects All Current Versions of Windows

There is a serious vulnerability in Java that leaves users running any of the current versions of Windows open to simple Web-based attacks that could lead to a complete compromise of the affected system. Two separate researchers released information on the vulnerability on Friday, saying that it...

Oracle JRE Java Platform SE and Java Deployment Toolkit Plugins Code Execution Vulnerabilities

Description Java Runtime Environment JRE is prone to arbitrary code-execution vulnerabilities that affect multiple Java plugins for multiple browsers. Attackers can exploit these issues to execute arbitrary code in the context of the user running the vulnerable applications. The issues affect Jav...

png -- libpng decompression buffer overflow

The PNG project describes the problem in an advisory: Several versions of libpng through 1.4.2 and through 1.2.43 in the older series contain a bug whereby progressive applications such as web browsers or the rpng2 demo app included in libpng could receive an extra row of image data beyond the...

Safari browser port blocking bypassed by integer overflow

g . o . a . t . s . e s . e . c . u . r . i . t . y g . a . p . i . n . g h . o . l . e . s e . x . p . o . s . e . d http://security.goatse.fr/ 323 306-4576 attention: due to technical limitations, this advisory cannot be displayed correctly. to view with images and video, visit the following...

Microsoft Windows Media Player Plug-in Buffer Overflow (CVE-2006-0005)

Microsoft Windows Media Player is an application that is used to play various media files, such as those compressed with AVI, MP3, MPG formats and so on. Windows Media Player runs on Microsoft Windows platforms, including Windows 2000, Windows XP and Windows Server 2003. Windows Media Player...

ZDI-10-030: Apple WebKit CSS run-in Attribute Rendering Remote Code Execution Vulnerability

ZDI-10-030: Apple WebKit CSS run-in Attribute Rendering Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-030 March 16, 2010 -- Affected Vendors: Apple Google -- Affected Products: Apple WebKit Apple Safari Google Chrome -- TippingPointTM IPS Customer...

...because you can't get enough of clickjacking

I promise to post something more interesting shortly - but in the meantime, I wanted to drop a quick note about something kinda amusing. There was a considerable amount of buzz around clickjacking 1 in the past year or so. It is commonly believed that this simple attack can only be realistically...

Opera Bug Can Crash Browser

A security vulnerability identified in Opera can be exploited to crash users’ browsers, but probably can’t lead to the remote execution of malware, a company spokesman said. Read the full article. The Register...

JVN#73331060 tDiary plugin tb-send.rb vulnerable to cross-site scripting

tDiary is a weblog software. tDiary plugin tb-send.rb contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on some web browsers. Solution Update the Software Update according to the information provided by the developer. Products Affected tDiary 2.2.2full set...

CanSecWest Pwn2Own Hacker Contest Targets Smartphones

The organizers of this year’s CanSecWest Pwn2Own have painted a big bulls-eye on mobile devices, offering up an whopping $60,000 in prizes to entice hackers to exploit vulnerabilities on iPhones, Android, Nokia and BlackBerry smartphones. At Pwn2Own 2010, which takes place in Vancouver on March 2...

Mozilla Browsers JavaScript Argument Passing Code Execution (CVE-2007-0777)

Mozilla Firefox and Seamonkey are very popular open source web browsers from Mozilla Foundation, based on the Mozilla Suite code base. The browser is an application designed for tasks related to web browsing, such as displaying HTML pages, downloading files, rendering different media, and so on...

Multiple Browsers - Address bar Characters

Securitylab.ir Application Info: Name: Internet Explorer Version: 8.0 Other tested browsers that also automatically convert "" to "/": - Firefox v3.6 - Google Chrome 4.0.249.78 36714 Vulnerability: IE address bar characters into a small feature My IE 8 on the address bar will automatically enter...

Man in the Middle Fix For SSL Is Ready

The Internet Engineering Task Force IETF has completed a security extension to the Secure Sockets Layer SSL protocol that fixes a flaw affecting browsers, servers, smart cards, and VPN products, as well as many lower-profile devices, such as Webcams, that contain the protocol embedded in their...

Adobe Reader Plugin Malformed URL Cross-Site Scripting (APSB07-01; CVE-2007-0045; CVE-2007-0048)

Multiple cross-site scripting XSS vulnerabilities have been discovered in Adobe Reader and Acrobat Plugin when used with various Web browsers. The vulnerabilities are due to an error in the Adobe Acrobat Reader Plugin...

Mozilla URL spoofing via invalid document.location

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to...