Touch events are shared across iframes — Mozilla

Mozilla developer Wesley Johnston reported that when there are two or more iframes on the same HTML page, an iframe is able to see the touch events and their targets that occur within the other iframes on the page. If the iframes are from the same origin, they can also access the properties and...

GreenBrowser iframe Handling Double Free Vulnerability - Windows

GreenBrowser is prone to double free vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Massive Injection Campaign Affecting More Than Six Million Pages

We recently reported on a massive drive-by-download campaign affecting some 90,000 Web pages. In the less than two weeks since that report, the same campaign is now affecting more than six million pages. The obvious question is: why has there been such an aggressive increase in the number of...

UBUNTU-CVE-2010-2646

Google Chrome before 5.0.375.99 does not properly isolate sandboxed IFRAME elements, which has unspecified impact and remote attack vectors...

Google Chrome < 5.0.375.99 Multiple Vulnerabilities

Binary data 800949.prm...

Google Chrome < 5.0.375.99 Multiple Vulnerabilities

Binary data 5591.pasl...

AdMan Standalone Ad Server Cross Site Scripting / SQL Injection

=========================================================== AdMan Standalone Ad Server SQLi AND XSS Vulnerability =========================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ ...

CVE-2010-1991

Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service excessive application launches via an HTML document with many IFRAM...

Scriptable plugin execution in SeaMonkey mail — Mozilla

Security researcher Georgi Guninski reported that scriptable plugin content, such as Flash objects, could be loaded and executed in SeaMonkey mail messages by embedding the content in an iframe inside the message. If a user were to reply to or forward such a message, malicious JavaScript embedded...

Hackers Using XSS to Insert iFrames in New Attack

In a new twist on a couple of old attack techniques, hackers have begun using cross-site scripting to inject malicious iFrames onto some Web sites, redirecting users to malicious sites designed to install unwanted software. The new attack, which leads to the installation of a rogue antivirus...

CGI Helper 1.0 xss

No description provided by source. CGI Helper 1.00 Download: http://www.sourcecodeonline.com/details/cgihelper.html Discovered by: Paulo Santos Contact: [email protected] Blog: http://infocampo.wordpress.com The script CGI Helper 1.00 is vulnerable to XSS. Example:...

CGI Helper 1.00 Cross Site Scripting

CGI Helper 1.00 Download: http://www.sourcecodeonline.com/details/cgihelper.html Discovered by: Paulo Santos Contact: [email protected] Blog: http://infocampo.wordpress.com The script CGI Helper 1.00 is vulnerable to XSS. Example: www.site.com/cgi-bin/helper.cgi XSS:...

CGI Helper 1.0 xss

Exploit for unknown platform in category web applications ================== CGI Helper 1.0 xss ================== CGI Helper 1.00 Download: http://www.sourcecodeonline.com/details/cgihelper.html The script CGI Helper 1.00 is vulnerable to XSS. Example: www.site.com/cgi-bin/helper.cgi XSS:...

New attack class exploits intranet weaknesses

A security researcher has developed an interesting new class of attacks that exploit the problems caused by organizations using non-routable IP space on their internal networks, including one attack that compromises VPN users through the use of a persistent JavaScript backdoor. The attacks rely o...

DoS vulnerabilities in Firefox, Internet Explorer, Opera and Chrome

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Denial of Service уязвимостях в браузерах Mozilla Firefox, Internet Explorer, Opera та Google Chrome. Данную атаку я назвал DoS через ифреймы DoS via iframes attack. И она относится к типу DoS http://websecurity.com.ua/2550/ через потребление...

Character Encoding Inheritance in iframes Can Enable Cross-Site Scripting

Pages displayed inside an iframe will inherit the character encodingof the parent page, unless they specify their own character encoding.A malicious page that uses the UTF-7 character encoding can includeother sites, for example inside iframes. This can be exploited toperform cross-site scripting...

CVE-2008-4582

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive...

A web Trojan samples to obtain a simple process-vulnerability warning-the black bar safety net

The morning our server is hanging Horse, the analysis of the next, by the step to write out! Share, nothing technical content, the master can skip! Yesterday evening found the Trojan to do a simple analysis, the Trojan path is: http://www.. com/ma/web.htm Think of a way to get its source code, it...

USN-447-1: KDE library vulnerabilities

It was discovered that Konqueror did not correctly handle iframes from JavaScript. If a user were tricked into visiting a malicious website, Konqueror could crash, resulting in a denial of service. CVE-2007-1308 A flaw was discovered in how Konqueror handled PASV FTP responses. If a user were...

CVE-2002-1151: Undefined Security Weakness

The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains...