Exploiting Browser Cookies to Bypass HTTPS and Steal Private Information

A newly discovered critical flaw in the implementation of web cookies by major browsers could open secured HTTPS browsing to Man-in-the-middle attacks. The US Computer Emergency Response Team CERT has revealed that all the main browser vendors have improperly implemented the RFC 6265 Standard, al...

X2Engine 4.2 - Cross-Site Request Forgery

X2Engine 4.2 - Cross-Site Request Forgery Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5075/ Details: It was discovered that no protection against Cross-site Request Forgery attacks was implemented, resulting in an attacker being able to...

NeoKylin: China's Linux OS that Seriously Looks Like Windows XP

Do You Know: China has planned to eliminate all foreign Technologies and Services by 2020, just like Google and Facebook. And it seems China in some years would be an entirely independent IT economy; building homegrown Mobile and computer devices, Operating Systems, Applications, Browsers and...

Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure

Posted by Mateusz Jurczyk of Google Project Zero In the previous series of posts parts 1 2 3 4, we discussed the exploitation process of a serious “blend” vulnerability CVE-2015-0093 / CVE-2015-3052, which was special in that it provided the attacker with an extremely powerful primitive arbitrary...

CVE-2015-2542

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability."...

CVE-2015-2494

Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490,...

Memory corruption

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability."...

Memory corruption

Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490,...

The vulnerability of the Firefox OS operating system, as well as the Firefox and Firefox ESR browsers, allows attackers to circumvent access restrictions, read arbitrary files, and increase their privileges.

The vulnerability of the PDF reader component in the Firefox OS operating system, as well as in Firefox and Firefox ESR browsers, is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access controls, read arbitrary files, and...

CVE-2015-2542

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability."...

Filet-o-Firewall UPnP Security Vulnerability in Home Routers

Security vulnerabilities in UPnP continue to crop up and continue to put millions of home networking devices at risk for compromise. The latest was revealed in early August, but prompted an advisory yesterday from the DHS-sponsored CERT at the Software Engineering Institute at Carnegie Mellon...

Vulnerabilities Identified in Dolphin, Mercury Android Browsers

Vulnerabilities exist in two fairly popular alternative browsers for Android – Dolphin and Mercury — that depending on the browser could result in either remote code execution or arbitrary read/write access. Mobile security researcher Benjamin Watson, who blogs under the guise of Rotlogix...

Server: Stored XSS in "activity" application

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Juniper Networks Junos J-Web Cross-Site Scripting Vulnerability

Juniper Networks Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. A cross-site scripting vulnerability exists in Juniper Networks Junos, which arises from the program's...

WordPress WP Rollback plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL server set up a personal blog site . WP Rollback is one of the theme rollback plugin . A cross-site scripting vulnerability exists in the WordPress W...

Zero-Day Flash Player Exploit Disclosed in 'Hacking Team' Data Dump

The Recent Cyber Attack that exposed 400GB of corporate data belonging to surveillance software firm Hacking Team has revealed that the spyware company have already discovered an exploit for an unpatched zero-day vulnerability in Flash Player. Security researchers at Trend Micro claim that the...

Stored XSS in "activity" application - ownCloud

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Steganography Over JPEG

A remote code execution vulnerability has been reported in the way web browsers handle embedded content. To trigger this issue, an attacker may embed a malicious JPEG file in a webpage. Successful exploitation of this vulnerability will allow execution of arbitrary code on the vulnerable system...

Privacy Proponents In Favor of Tracking Protection for Firefox

Privacy advocates are calling on Mozilla to better deploy Tracking Protection, a technology that offers more stringent privacy and speeds up page loads by blocking requests to tracking domains, in its Firefox browser. The functionality has existed in the browser for months but the idea of making ...

Multi Purpose Fuzzer: zzuf

Multi Purpose Fuzzer zzuf is a transparent application input fuzzer. Its purpose is to find bugs in applications by corrupting their user-contributed data which more than often comes from untrusted sources on the Internet. It works by intercepting file and network operations and changing random...