2807 matches found
New vulnerabilities in OpenX
Hello 3APA3A! I want to warn you about Denial of Service, Cross-Site Scripting and Redirector vulnerabilities in OpenX. DoS Looped DoS: http://site/adclick.php About Looped DoS I wrote in my classification of DoS vulnerabilities in web applications http://websecurity.com.ua/2663/. Vulnerable are...
Mozilla Firefox IFRAME Cross Site Scripting (CVE-2005-1476)
Mozilla browsers use the W3C Document Object Model DOM to provide a structural representation of an HTML document and define the way this structure is to be accessed from scripts. One of the core objects exposed by DOM is the window object, which is used to represent a browser window. An HTML pag...
Mozilla Releases Preview Builds of Firefox with Content Security Policy
Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks. The CSP specification is Mozilla’s effort to provide Web site operators with a simpler way to...
Firefox Add-on Spies on Google Search Results
Security researchers have intercepted a fake Flash Player update creating a Firefox add-on that spies on the user’s Google search results. The malicious Firefox extension, called “Adobe Flash Player 0.2,” injects ads into the user’s Google search results pages and even has the capability to monit...
DoS in multiple browsers
Hang or crash on oversized location.hash...
RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2008:0132)
Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.4.2 SR10 Java release includes the IBM...
RHEL 3 / 4 / 5 : flash-plugin (RHSA-2008:0221)
An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security...
Serious Cracks Showing in SSL, AES
The cryptographic underpinnings of the Internet are beginning to show some serious wear, and the outlook for better days ahead is not particularly rosy. In just the last week there has been news of major new attacks on perhaps the two most widely used encryption technologies: SSL and AES. We’ve...
Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....
One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Update/Changes : ---------------- Backround : + I failed to include details about the nature of the bug DOM, the root cause is a DOM flaw and not a Javascrip...
Multiple browsers DoS
select method doesn't limie the number of selected elements, leading to resources exhaustion...
Multiple browsers DoS
Crash or resources exhaustion on oversized unicode string operations via Javascript...
New DOM Flaw Can Crash IE, Other Major Browsers
From The H Security The Luxembourg security specialists G-SEC have published details of a vulnerability in the majority of browsers which will either crash the browser or consume so much memory that it makes the computer virtually unusable. The trick is simple. Using JavaScript’s DOM Document...
[GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....
One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - One bug to rule them all WWW :...
Multiple Web Browsers Denial of Service Exploit (1 bug to rule them all)
No description provided by source. One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - One b...
Awingsoft Awakening Winds3D Viewer remote command execution vulnerability
Advisory ID Internal CORE-2009-0519 1. Advisory Information Title: Awingsoft Awakening Winds3D Viewer remote command execution vulnerability Advisory ID: CORE-2009-0519 Advisory URL:http://www.coresecurity.com/content/winds3d-viewer-advisory Date published: 2009-07-08 Date of last update:...
Mozilla Tackles XSS Vulnerabilities, Clickjacking Attacks
Mozilla’s security engineers are working on new technology that promises to mitigate a large class of Web application vulnerabilities, especially the cross-site scripting XSS plague against modern Web browsers. The project, called Content Security Policy, is designed to shut down XSS attacks by...
file: resources
Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with...
DoS vulnerabilities in Firefox, Internet Explorer and Opera
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Denial of Service уязвимостях в браузерах Firefox, Internet Explorer и Opera. Некоторое время назад была опубликована DoS уязвимость в Mozilla Firefox http://websecurity.com.ua/3214/ найденная Wojciech Pawlikowski. После публикации эксплоита к...
URL Spoofing vulnerabilities in browsers and search engines
Hello 3APA3A! I continue the topic, which I begun in previous two advisories about URL Spoofing vulnerability http://websecurity.com.ua/3079/ in GoogleBot, Yahoo! Slurp, Mozilla and Internet Explorer http://websecurity.com.ua/3096/, which also can exists in bots of other search engines. And I tel...