RHEL 2.1 : zebra (RHSA-2003:305)

Updated zebra packages that close a locally-exploitable and a remotely-exploitable denial of service vulnerability are now available. Zebra an open source implementation of TCP/IP routing software. Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled an...

Microsoft Internet Explorer does not properly validate source of redirected frame

Overview Microsoft Internet Explorer IE does not adequately validate the security context of a frame that has been redirected by a web server. An attacker could exploit this vulnerability to evaluate script in different security domains. By causing script to be evaluated in the Local Machine Zone...

PT-2004-1312 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook version 2002 Description: The issue concerns an argument injection vulnerability where Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE. Thi...

Low: Red Hat Security Advisory: iproute security update

Updated iproute packages that close a locally-exploitable denial of service vulnerability are now available. The iproute package contains advanced IP routing and network device configuration tools. Herbert Xu reported that iproute can accept spoofed messages sent on the kernel netlink interface b...

Microsoft Internet Explorer does not properly evaluate Content-Type and Content-Disposition headers

Overview A cross-domain scripting vulnerability exists in the way Microsoft Internet Explorer IE evaluates Content-Type and Content-Disposition headers and checks for files in the local browser cache. This vulnerability could allow a remote attacker to execute arbitrary script in a different...

Microsoft Internet Explorer does not adequately validate window ornament parameters in dialog frames

Overview A vulnerability in the way Microsoft Internet Explorer IE handles window ornament parameters in dialog frames allows script from a dialog frame in one domain to execute in a different domain, including the Local Machine Zone. The script could read certain local files and data i.e. cookie...

Microsoft Security Bulletin MS03-014: Cumulative Patch for Outlook Express (330994)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Cumulative Patch for Outlook Express 330994 Date: 23 April 2003 Software: Microsoft c Outlook Express Impact: Run code of the attacker's choice on a user's machine. Max Risk: Critica...

Microsoft Internet Explorer contains cross-site scripting vulnerabilities in local HTML resources

Overview Microsoft Internet Explorer IE includes several local HTML resources that contain cross-site scripting vulnerabilities. These resources use the dialogArguments property of dialog frames insecurely, allowing an attacker to execute arbitrary script in the Local Machine Zone. Description...

Cookie access via res:\\ and about:\\ in Microsoft Internet Explorer

It's possible to use about: and res: URl to execute javascript in context of any page and local machine...

Microsoft Internet Explorer Permits Remote Command Execution Through <OBJECT> Tag

Overview Microsoft Internet Explorer IE permits the remote execution of arbitrary commands via the tag. Description A vulnerability exists in the way that Microsoft Internet Explorer IE handles tags. If the CLASSID CLSID is unrecognized, then Internet Explorer will execute arbitrary commands...

Microsoft Windows NT 4.02000 - Spoofed LPC Request (MS00-003)

Microsoft Windows NT 4.02000 - Spoofed LPC Request MS00-003 source: https://www.securityfocus.com/bid/1753/info This vulnerability is a new variation of the NT LPC Privilege Escalation Vulnerabilty please see https://www.securityfocus.com/bid/934 for details reported on January 12, 2000 by...

Security Bulletin (MS00-020)

Microsoft Security Bulletin MS00-020 - -------------------------------------- Patch Available for "Desktop Separation" Vulnerability Originally Posted: June 15, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Windowsr 2000. The...

PT-1999-1202 · Microsoft · Windows Nt

Name of the Vulnerable Software and Affected Versions: Windows NT affected versions not specified Description: The issue concerns the HKEY LOCAL MACHINE key in a Windows NT system, which has inappropriate, system-critical permissions. Recommendations: At the moment, there is no information about ...