2796 matches found
CVE-2009-4197
rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 contains a form that does not disable the autocomplete setting for the password parameter, which makes it easier for local users or physically proximate attackers to obtain the password from web browsers that support...
CVE-2009-3931
Incomplete blacklist vulnerability in browser/download/downloadexe.cc in Google Chrome before 3.0.195.32 allows remote attackers to force the download of certain dangerous files via a "Content-Disposition: attachment" designation, as demonstrated by 1 .mht and 2 .mhtml files, which are...
Web Security Flaws Up 10% in 2009
Almost 80% of more than 3,000 software security flaws publicly reported so far this year have been in Web technologies such as Web servers, applications, plugins and Web browsers. That number is about 10% higher than the number of flaws reported in the same period last year — and nine out of 10 o...
Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass
Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass source: https://www.securityfocus.com/bid/35888/info Mozilla Network Security Services NSS is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate,...
Multiple Browsers Telnet URI Handler File Manipulation (CVE-2004-0411; CVE-2004-0473)
There exists a vulnerability that affects various web-browsers. Insufficient input validation for telnet URI e.g., telnet://hostname can cause the Telnet software activated by the browsers to treat specially crafted Telnet URI as command-line options. As such, a malicious attacker may be able to...
Gumblar Attacks Spread to Thousands of New Sites
Gumblar, the nasty bit of malware that was part of a mass SQL injection on legitimate Web sites this spring, is continuing to spread and its creators have been busy lately, compromising hundreds of new sites, leading to a massive new wave of infections of end-user PCs. Gumblar first hit the scene...
Preemptive Protection against Adobe Reader and Acrobat Mozilla plug-in Remote Code Execution Vulnerability (APSB09-15)
A remote code execution vulnerability has been discovered in Adobe Reader and Acrobat. A remote attacker could implant a shell code on a target system using heap spray exploitation method. Heap spraying is a technique for exploiting vulnerabilities in internet browsers e.g. Internet Explorer,...
Adobe Acrobat < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)
The version of Adobe Acrobat installed on the remote host is earlier than 9.2 / 8.1.7 / 7.1.4. Such versions are reportedly affected by multiple vulnerabilities : - A heap overflow vulnerability. CVE-2009-3459 - A memory corruption issue. CVE-2009-2985 - Multiple heap overflow vulnerabilities...
Mozilla Browsers CSS moz-binding Cross Domain Scripting (CVE-2006-0496)
The Mozilla based web browsers are full featured web browsers which serve as popular alternatives to the Microsoft Internet Explorer. The browsers are capable of interpreting HTML, JavaScript, CSS, as well as a myriad of other popular Internet standard formats. The Mozilla based browsers are...
New vulnerabilities in OpenX
Hello 3APA3A! I want to warn you about Denial of Service, Cross-Site Scripting and Redirector vulnerabilities in OpenX. DoS Looped DoS: http://site/adclick.php About Looped DoS I wrote in my classification of DoS vulnerabilities in web applications http://websecurity.com.ua/2663/. Vulnerable are...
Mozilla Firefox IFRAME Cross Site Scripting (CVE-2005-1476)
Mozilla browsers use the W3C Document Object Model DOM to provide a structural representation of an HTML document and define the way this structure is to be accessed from scripts. One of the core objects exposed by DOM is the window object, which is used to represent a browser window. An HTML pag...
Mozilla Releases Preview Builds of Firefox with Content Security Policy
Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks. The CSP specification is Mozilla’s effort to provide Web site operators with a simpler way to...
Firefox Add-on Spies on Google Search Results
Security researchers have intercepted a fake Flash Player update creating a Firefox add-on that spies on the user’s Google search results. The malicious Firefox extension, called “Adobe Flash Player 0.2,” injects ads into the user’s Google search results pages and even has the capability to monit...
DoS in multiple browsers
Hang or crash on oversized location.hash...
RHEL 3 / 4 / 5 : flash-plugin (RHSA-2008:0221)
An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security...
RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2008:0132)
Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.4.2 SR10 Java release includes the IBM...
Serious Cracks Showing in SSL, AES
The cryptographic underpinnings of the Internet are beginning to show some serious wear, and the outlook for better days ahead is not particularly rosy. In just the last week there has been news of major new attacks on perhaps the two most widely used encryption technologies: SSL and AES. We’ve...
Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....
One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Update/Changes : ---------------- Backround : + I failed to include details about the nature of the bug DOM, the root cause is a DOM flaw and not a Javascrip...