3012 matches found
Browsers and search systems URL spoofing
By using xx in host name it's possible to spoof URL origin...
URL Spoofing vulnerabilities in browsers and search engines
Hello 3APA3A! I continue the topic, which I begun in previous two advisories about URL Spoofing vulnerability http://websecurity.com.ua/3079/ in GoogleBot, Yahoo! Slurp, Mozilla and Internet Explorer http://websecurity.com.ua/3096/, which also can exists in bots of other search engines. And I tel...
FreeBSD : URI handler vulnerabilities in several browsers (df333ede-a8ce-11d8-9c6d-0020ed76ef5a)
Karol Wiesek and Greg MacManus reported via iDEFENSE that the Opera web browser contains a flaw in the handling of certain URIs. When presented with these URIs, Opera would invoke external commands to process them after some validation. However, if the hostname component of a URI begins with a -'...
SMA-DB 0.3.13 Multiple Remote File Inclusion Vulnerabilities
No description provided by source. SMA-DB 0.3.13 Multiple Remote File Inclusion Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://bluevirus.ch/media/downloads/SMA-DBv0.3.13.zip - about SMA-DB:...
SMA-DB 0.3.13 Remote File Inclusion
SMA-DB 0.3.13 Multiple Remote File Inclusion Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://bluevirus.ch/media/downloads/SMA-DBv0.3.13.zip - about SMA-DB: Written in PHP4: SMA-DB is a Databa...
SMA-DB 0.3.13 - Multiple Remote File Inclusions
SMA-DB 0.3.13 - Multiple Remote File Inclusions SMA-DB 0.3.13 Multiple Remote File Inclusion Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://bluevirus.ch/media/downloads/SMA-DBv0.3.13.zip -...
SMA-DB 0.3.13 - Multiple Remote File Inclusions
SMA-DB 0.3.13 Multiple Remote File Inclusion Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://bluevirus.ch/media/downloads/SMA-DBv0.3.13.zip - about SMA-DB: Written in PHP4: SMA-DB is a Databa...
Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari
All three major Web browsers — Microsoft’s Internet Explorer 8, Mozilla Firefox and Apple’s Safari — failed to survive the hacker onslaught at this year’s CanSecWest Pwn2Own contest. A security researcher named “Nils” he declined to provide his full name performed a clean drive-by download attack...
Cross site scripting
Cross-site scripting XSS vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK. NOTE: the vendor states that the product is...
Multiple browsers inherited charset crossite scripting
If age with undefined charset is displayed in frame, codepage of parent page is used. It makes it possible to conduct crossite scripting attack with e.g. UTF-7, EUC-JP SHIFTJIS charset...
Pwn2Own hacker: Safari is 'easy pickings'
Charlie Miller right, the security researcher who won last year’s Pwn2Own hacker contest, is predicting that Apple’s Safari browser will be the easiest target this year. In a note posted on the popular Daily Dave mailing list, Miller describes Safari as “easy pickin’s” and forecasts that at least...
Pwn2Own 2009: Browsers and smart phones are targets
TippingPoint’s Zero Day Initiative has released the rules for this year’s CanSecWest PWN2OWN contest, which will target unpatched flaws in Web browsers and mobile devices. Among the target list this year: Microsoft’s Internet Explorer 8, Apple’s Safari, Google’s Chrome, Windows Mobile, Google...
CVE-2009-0417
Cross-site scripting XSS vulnerability in the AgaviWebRouting::gennull method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not...
Cross site scripting
Cross-site scripting XSS vulnerability in the AgaviWebRouting::gennull method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not...
Cross site scripting
Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting XSS and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers...
CVE-2009-0417
Cross-site scripting XSS vulnerability in the AgaviWebRouting::gennull method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not...
SSL Certificate Forgery via MD5 Collision Attacks
Public key infrastructure PKI is a mechanism used for issuing digital certificates for secure websites. A critical vulnerability was detected in PKI that enables attackers to create a forged digital certificate that will be trusted by all common web browsers. The vulnerability is due to a weaknes...
[SECURITY] Fedora 10 Update: squirrelmail-1.4.17-2.fc10
SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...
[Full-disclosure] [SVRT-05-08] Critical BoF vulnerability found in ffdshow affecting all internet browsers (SVRT-Bkis)
General Information ffdshow is a DirectShow filter and VFW codec for many audio and video formats, such as DivX, Xvid and H.264. It is the most popular audio and video decoder on Windows. Besides a stand-alone setup package, ffdshow is often included in almost all codec pack software such as...