Unfixed XSS vulnerability at www.vapiano-people.com

Security researcher Nils Juenemann, has submitted on 30/03/2011 a cross-site-scripting XSS vulnerability affecting www.vapiano-people.com, which at the time of submission ranked 853630 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011...

[security bulletin] HPSBMI02580 SSRT100254 rev.1 - Palm webOS, Code execution vulnerability in Palm webOS service API

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02516786 Version: 1 HPSBMI02580 SSRT100254 rev.1 - Palm webOS, Code execution vulnerability in Palm webOS service API NOTICE: The information in this Security Bulletin should be acted upon as soo...

Design/Logic Flaw

Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collectio...

CVE-2010-1121

Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collectio...

Mozilla Fast-Tracks Fix For Critical Firefox Flaw

Mozilla has fast-tracked a patch for a critical vulnerability affecting its flagship Firefox browser. The patch, which was originally slated for release on March 30, fixes a vulnerability that could allow remote code execution attacks. The flaw was originally released into the VulnDisco exploit...

The Global Illicit Economy

Nils Gilman, an author and entrepreneur, details the common themes and techniques that connect the actors in the illicit economies around the world, including the malware and botnet economies...

openSUSE Security Update : MozillaFirefox (MozillaFirefox-745)

The Mozilla Firefox Browser was updated to the 3.0.8 release. It fixes several security issues : MFSA 2009-13 / CVE-2009-1044: Security researcher Nils reported via TippingPoint's Zero Day Initiative that the XUL tree method moveToEdgeShift was in some cases triggering garbage collection routines...

ZDI-09-015: Mozilla Firefox XUL _moveToEdgeShift() Memory Corruption Vulnerability

ZDI-09-015: Mozilla Firefox XUL moveToEdgeShift Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-015 March 30, 2009 -- CVE ID: CVE-2009-1044 -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox 3.0.x -- Vulnerability Details: This...

Arbitrary code execution via XUL tree element — Mozilla

Security researcher Nils reported via TippingPoint's Zero Day Initiative that the XUL tree method moveToEdgeShift was in some cases triggering garbage collection routines on objects which were still in use. In such cases, the browser would crash when attempting to access a previously destroyed...

CVE-2009-1043

Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009...

CVE-2009-1044

Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009...

Design/Logic Flaw

Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009...

Design/Logic Flaw

Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009...

CVE-2009-1043

CVE-2009-1043 affects Microsoft Internet Explorer 8 on Windows 7. The vulnerability allows remote code execution via unknown vectors triggered by clicking a link, demonstrated during PWN2OWN 2009. The public records describe an unspecified vulnerability with IE8/Win7; no concrete root-cause, affe...

CVE-2009-1042

Affected software is Apple Safari on Mac OS X 10.5.6. The vulnerability is described as an unspecified remote code execution triggered by clicking a link, demonstrated during PWN2OWN 2009. No concrete root-cause details, affected subcomponents, or remediation/version fixes are provided in the con...

CVE-2009-1042

Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009...

CVE-2009-1043

Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009...

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari

All three major Web browsers — Microsoft’s Internet Explorer 8, Mozilla Firefox and Apple’s Safari — failed to survive the hacker onslaught at this year’s CanSecWest Pwn2Own contest. A security researcher named “Nils” he declined to provide his full name performed a clean drive-by download attack...

CVE-2006-1889

The CVE concerns Boardsolution (SCRIPTSOLUTION) by Nils Asmussen, specifically Boardsolution 1.12 and earlier. Vulnerable component: the search action handler in index.php. Issue: cross-site scripting (XSS) via the keyword parameter in the "Search for" input, allowing remote attackers to inject a...

[Full-disclosure] Replay Attack Vulnerability on Sonys Instant Video Everywhere Service

Replay Attack Vulnerability on Sonys Instant Video Everywhere Service http://www.iptel.org/security/2005-12-31.html December 31, 2005 I. Background Sony offers a SIP based voice and video service called IVE. By downloading a client application for the Windows operating system everybody can make...