iDEFENSE Security Advisory 04.26.05: Citrix Program Neighborhood Agent Arbitrary Shortcut Creation Vulnerability

Citrix Program Neighborhood Agent Arbitrary Shortcut Creation Vulnerability iDEFENSE Security Advisory 04.26.05 www.idefense.com/application/poi/display?id=237&type=vulnerabilities April 26, 2005 I. BACKGROUND Citrix Program Neighborhood Agent is a part of the Citrix Presentation Server Client an...

[Full-disclosure] Cisco Security Advisory: Crafted ICMP Messages Can Cause Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Crafted ICMP Messages Can Cause Denial of Service Revision 1.0 For Public Release 2005 April 12 1200 UTC GMT +---------------------------------------------------------------------- Contents ======== Summary Affected Products...

Microsoft Windows Shell Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a vulnerability that may allow remote attackers to execute code through the Windows Shell. The cause of the vulnerability is related to how the operating system handles unregistered file types. The specific issue is that files with an unknown extension ma...

KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing

KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing source: https://www.securityfocus.com/bid/13085/info A remote email message content spoofing vulnerability affects KDE KMail. This issue is due to a failure of the application to properly sanitize HTML email messages. An attacker may...

KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing

source: https://www.securityfocus.com/bid/13085/info A remote email message content spoofing vulnerability affects KDE KMail. This issue is due to a failure of the application to properly sanitize HTML email messages. An attacker may leverage this issue to spoof email content and various header...

Cisco IOS contains DoS vulnerability in MPLS packet processing

Overview A denial-of-service vulnerability exists in Cisco's Internetwork Operating System IOS. This vulnerability may allow attackers to conduct denial-of-service attacks on an affected device. Description Multi Protocol Label Switching MPLS is designed to increase the speed of IP...

Multiple web browsers do not properly interpret TABLE elements when displaying URLs in the status bar

Overview Multiple web browsers do not properly display the location of HTML documents in the status bar. An attacker could exploit this behavior to mislead users into revealing sensitive information. Description Web browsers frequently display the Uniform Resource Locator URL in the status bar wh...

Debian DSA-099-1 : xchat - IRC session hijacking

zen-parse found a vulnerability in the XChat IRC client that allows an attacker to take over the users IRC session. It is possible to trick XChat IRC clients into sending arbitrary commands to the IRC server they are on, potentially allowing social engineering attacks, channel takeovers, and deni...

[Full-Disclosure] iDEFENSE Security Advisory 08.12.04a: Adobe Acrobat Reader (Unix) Shell Metacharacter Code Execution Vulnerability

Adobe Acrobat Reader Unix Shell Metacharacter Code Execution Vulnerability iDEFENSE Security Advisory 08.12.04a www.idefense.com/application/poi/display?id=124&type=vulnerabilities August 12, 2004 I. BACKGROUND Adobe Acrobat Reader is a program for viewing Portable Document Format PDF documents...

[Full-Disclosure] SoX buffer overflows when handling .WAV files

SoX buffer overflows when handling .WAV files I have found two buffer overflows in SoX. They occur when the sox or play commands handle malicious .WAV files. The overflows have the identifier CAN-2004-0557. Versions 12.17.4, 12.17.3 and 12.17.2 are vulnerable to these overflows. Vulnerable versio...

dnsPoison.cpp.txt

Symantec Enterprise Firewall dnsd proxy, versions 8 and later, is vulnerable to cache poisoning attacks when acting as a caching nameserver. Is possible to inject false entries in its cache and make a false DNS server look like authoritative of a zone, when it is not. Once this information is...

Symantec Enterprise Firewall DNSD cache poisoning Vulnerability

Symantec Enterprise Firewall dnsd proxy, versions 8 and later, is vulnerable to cache poisoning attacks when acting as a caching nameserver. Is possible to inject false entries in its cache and make a false DNS server look like authoritative of a zone, when it is not. Once this information is...

mplayer heap overflow in http requests

A remotely exploitable heap buffer overflow vulnerability was found in MPlayer's URL decoding code. If an attacker can cause MPlayer to visit a specially crafted URL, arbitrary code execution with the privileges of the user running MPlayer may occur. A visit' might be caused by social engineering...

Microsoft Internet Explorer does not properly display URLs

Overview Microsoft Internet Explorer does not properly display the location of HTML documents. An attacker could exploit this behavior to mislead users into revealing sensitive information. Description Web browsers frequently display the Uniform Resource Locator URL in the address bar. Users expe...

RemotelyAnywhere - Default.HTML Logout Message Injection

RemotelyAnywhere - Default.HTML Logout Message Injection source: https://www.securityfocus.com/bid/9202/info RemotelyAnywhere has been reported prone to a logout message injection weakness. It has been reported that this issue presents itself due to a lack of sufficient restrictions performed by...

RemotelyAnywhere - Default.HTML Logout Message Injection

source: https://www.securityfocus.com/bid/9202/info RemotelyAnywhere has been reported prone to a logout message injection weakness. It has been reported that this issue presents itself due to a lack of sufficient restrictions performed by RemotelyAnywhere on user supplied 'reason' URI parameters...

CVE-2001-1410

Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering...

CVE-2001-1410

The connected CERT entry for CVE-2001-1410 documents that Internet Explorer window.createPopup() creates chromeless popup windows that can spoof the user interface, enabling phishing-style deception and potential interaction with local files. The vulnerability affects IE 6 and earlier and is miti...

CVE-2001-1410

Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering...

CVE-2001-1410: Undefined Security Weakness

Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering...