5116 matches found
Cross site scripting
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrat...
Information disclosure
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrat...
[hack4sec] XSS: Разведка боем.
Автор: Кузьмин Антон [email protected] Команда: Hack4sec [email protected] Дата: 30-05-2011 PDF-вариант: Здравствуйте. В данной статье я хочу привести один не стандартный пример использования XSS-уязвимостей. По крайней мере раньше я ни разу не видел чтоб подобные вещи где-то...
Geek.com Hacked, Found Hosting Exploit Kit
The security geeks at Geek.com were busy this weekend, after Web security firm zScaler found evidence that an exploit kit was using malicious iframe attacks to try to attack visitors to the company’s Web site, according to a Zscaler report Sunday. A post on the web security firm’s blog indicated...
A DNS suffix may lead to cross-domain security issues-vulnerability warning-the black bar safety net
We all know that dhcpd can be set in which the client's DNS suffix. For example, if we set the DNS suffix"sb.com”when we visit www. sb. com, all clients will use the DHCP server and try the following sequence for resolution. Note: the following green font are representative of the Main Domain Nam...
Goal.com Hacked, found to be serving malware !
According to Armorize, soccer news site Goal.com was recently found to be serving malware. "In an analysis of the attack, Armorize researcher Wayne Huang suggests that a hacker specifically targeted and compromised Goal.com through a back-door that allowed the attacker to manipulate the site's...
seamonkey security update
CentOS Errata and Security Advisory CESA-2011:0473 Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS ba...
Mozilla crash from bad iframe source (MFSA 2011-12)
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...
Critical: Red Hat Security Advisory: thunderbird security update
An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...
Mozilla crash from bad iframe source (MFSA 2011-12)
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...
Mozilla crash from bad iframe source (MFSA 2011-12)
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...
Mozilla crash from bad iframe source (MFSA 2011-12)
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...
Internet Explorer Malformed IFRAME Buffer Overflow (MS04-040; CVE-2004-1050)
Internet Explorer IE is a popular web browser developed by Microsoft corporation. A buffer overflow vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is in the way Microsoft Internet Explorer parses certain parameters of an IFRAME tag. An attacker can exploit this...
Unfixed XSS vulnerability at www.poumon.ca
Security researcher Gamoscu, has submitted on 04/09/2011 a cross-site-scripting XSS vulnerability affecting www.poumon.ca, which at the time of submission ranked 564377 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is currently...
Web Server iFrame Source Hosted on 3rd-party Server
Binary data 5877.prm...
JavaScript hole in Facebook !
Facebook made some important changes to the way in Facebook Pages, the fan pages set up by brands, bands and even cucumbers could be created. In the past the tabs which could be added to these pages have been set up in two ways; the first used the Facebook FBML app. This allowed page tabs to be...
VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free
VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with 4.45...
BBC Sites Serving Malware
The websites of the BBC’s 6 music and 1Xtra radio stations have been injected with a malicious iframe and are redirecting users to a site serving up malware according to a Websense report Tuesday. The iframe, on both the BBC 6 music and 1Xtra webpages, is loading code from a malicious website fro...
mediawiki -- Clickjacking vulnerabilities
Clickjacking vulnerabilities: Clickjacking is a type of vulnerability discovered in 2008, which is similar to CSRF. The attack involves displaying the target webpage in a iframe embedded in a malicious website. Using CSS, the submit button of the form on the targeit webpage is made invisible, and...
Cyber Fraud: Tactics, Techniques and Procedures
Gone are the days when those BlackHat Hackers would tickle you for fun, Now they will poke you & take your diamonds without you even knowing anything about it until it's too late. Landscape in the Cyber underground has completely changed since then, making it more like well organized business...