HackerOne: External URL page bypass

A specially crafted URL can bypass the external URL warning page. Details A url that starts with two forward slashes is treated as absolute by browsers. The markdown renderer refuses to render links that start like this, however it can be tricked by using a control character e.g. "test"...

ICU Project ICU4C Library Vulnerabilities Patched

Multitudes of software packages that make use of the ICU Project C/C++ and Java libraries may need to update after a pair of memory-based vulnerabilities were discovered and subsequently patched. Version 55.1 of the ICU Project ICU4C library, released yesterday, addresses separate heap-based buff...

Java.com Cross Site Scripting

Exploit Title: Java.com RXSS and DOM-XSS Date: 01/04/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.java.com Version: / Category: Reflected Cross Site Scripting and DOM based XSS Google dork: Tested on: Java.com main domain Java description :...

Google to Publish Research on Browser Ad Injectors

Google is preparing to release new research on the prevalence of ad injectors, the often-unwanted browser extensions that inject ads onto Web pages, and the numbers will show just how widespread and problematic the software is. Ad injectors belong to that great, amorphous pile of applications tha...

DDoS Attack Against GitHub Continues After More Than Four Days

More than four days after it began, the massive DDoS attack on GitHub is still ongoing. The attack has evolved significantly since it started and GitHub officials said they believe that the goal of the operation is to force the site to remove some specific content. In the evening hours of March 2...

Free Simple CMS Cross-Site Scripting Vulnerability

Free Simple CMS is an open source content management system CMS. The system supports customized templates and other features. A cross-site scripting vulnerability exists in Free Simple CMS, which stems from the program's failure to adequately filter user-submitted input. When a user browses the...

Barracuda Networks IM Firewall Cross-Site Scripting Vulnerability

Barracuda Networks IM Firewall is an instant messaging solution from Barracuda Networks that integrates an IM server, client management and security measures. The solution provides keyword identification and reporting, file transfer, IM traffic identification and logging. A cross-site scripting...

TinyWebGallery Cross-Site Scripting Vulnerability

TinyWebGallery TWG is a software developer Michael Dempfle developed a set of open source album based on Ajax, PHP and XML , it provides text and image watermarking , slide show , image uploading and management and other functions . A cross-site scripting vulnerability exists in TWG that stems fr...

Dotproject HTML Injection Vulnerability

Dotproject is a set of Web-based project management and tracking tools. The tool provides modules for company management, project management and task progress tracking. An HTML injection vulnerability exists in Dotproject, which stems from the program's failure to adequately filter user-submitted...

Adobe CVE-2011-2461 Remains Exploitable Via Flex Four Years After Patch

UPDATE: This article has been updated to add commentary and clarification from Adobe. A four year old Adobe Flash patch did not properly resolve a vulnerable Flex application, and attackers can exploit the bug, which is said to affect some 30 percent of Alexa’s top 10 most popular sites in the...

Chrome, Firefox, Safari and IE – All Browsers Hacked at Pwn2Own Competition

The Annual Pwn2Own Hacking Competition 2015 held in Vancouver is over and participants from all over the world nabbed $557,500 in bug bounties for 21 critical bugs in top four web browsers as well as Windows OS, Adobe Reader and Adobe Flash. During the second and final day of this year’s hacking...

CloudFlare Deploys ChaCha20-Poly1305 Encryption Across Sites

After rolling out free SSL for its users last fall, CloudFlare has deployed a new level of encryption on its service that hardens and speeds up the user experience, especially when accessing domains via mobile browsers. The form of encryption, a relatively new transport layer cipher suite known a...

libpng: User-assisted execution of arbitrary code

Background libpng is a standard library used to process PNG Portable Network Graphics images. It is used by several programs, including web browsers and potentially server processes. Description Two vulnerabilities have been discovered in libpng: The pnguserversioncheck function contains an...

WebRTC Found Leaking Local IP Addresses

A recently publicized hole in WebRTC, a protocol for web communication, is revealing the local IP addresses of users, even those who go to extra lengths to hide theirs by using a virtual private network. Daniel Roesler, a San Francisco-based researcher who’s dabbled in encryption, posted a...

Grinder - System to Automate the Fuzzing of Web Browsers

Grinder is a system to automate the fuzzing of web browsers and the management of a large number of crashes. Grinder Nodes provide an automated way to fuzz a browser, and generate useful crash information such as call stacks with symbol information as well as logging information which can be used...

[SECURITY] Fedora 21 Update: gd-2.1.0-8.fc21

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

Mozilla: Cookie injection through Proxy Authenticate responses (MFSA 2015-04)

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 aka Proxy Authentication Required status code, which allows remote HTTP proxy servers to conduct session...

Facebook Open Redirect

Facebook Old Generated URLs Still Vulnerable to Open Redirect Attacks & A New Open Redirect Security Vulnerability Domain: http://www.facebook.com Discover: Wang Jing, School of Physical and Mathematical Sciences SPMS, Nanyang Technological University NTU, Singapore...

Multiple Cross-Site Scripting Vulnerabilities in Koha

Koha is the first open source library automation system. Koha has multiple cross-site scripting vulnerabilities. Because the program fails to properly filter user-supplied input, an attacker could exploit these vulnerabilities to execute arbitrary script code in the context of a browser without t...

Each of the large browser vendors in the mobile browser present the same security issues-vulnerability warning-the black bar safety net

Test are millet 2s mobile phone, the affected vendors+test version numberthe latest version: Sogou browser myhack58: sogou mobile browser cross-domain scripting vulnerability, one of the Chat Hot Spring Resort browser series 9 9.5.1.79796 2 3 4 5 browser 5.6.2 Baidu hao123 Internet navigation...