CVE-2010-0715

CVE-2010-0715 is an open redirect vulnerability in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management, covering versions 5.1.0.0–5.1.0.5, 6.0.0.0–6.0.0.4, 6.0.1.0–6.0.1.7, 6.1.0.0–6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8....

Twitter Hit By Phishing Attack

Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts. Read the full article. The Register...

Chrome Password Manager Cross Origin Weakness (CVE-2010-0556)

Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Chrome Password Manager Cross Origin Weakness Release Date: 2010-02-15 Application: Google Chrome Web Browser Versions:...

Comerica Bank Sued for Failed 2-Factor Authentication

A metals supply company in Michigan is suing its bank for poor security practices after a successful phishing attack against an employee allowed thieves to steal more than half a million dollars last year. Read the full article. KrebsonSecurity...

Google Attack Was Tip of the Iceberg

The recent disclosure by Google, Adobe and other companies that their networks had been thoroughly compromised by attackers who may have been after their source code has prompted a tremendous amount of discourse both in the security community and in the general public about the political and...

PR09-15: XSS injection vulnerability within HP System Management Homepage (Insight Manager)

PR09-15: XSS injection vulnerability within HP System Management Homepage Insight Manager Vulnerability found: 11th October 2009 Severity: Medium Description: A XSS vulnerability has been found within HP System Management; Arising from insufficient input filtering. By using a specially-crafted...

SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection

Exploit Title: Silverstripe = 2.3.5 Cross Site Request Forgery & Open Redirection. Date: 12/01/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Vendor: www.silverstripe.org | Version: 2.0.0 Tested on: PHP Open Redirection: OWASP: An open redirect is an application that...

USN-878-1: Firefox 3.5 and Xulrunner 1.9.1 regression

USN-874-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream changes introduced a regression when using NTLM authentication. This update fixes the problem and adds additional stability fixes. We apologize for the inconvenience. Original advisory details: Jesse Ruderman, Josh Soref,...

Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-873-1)

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary...

USN-874-1: Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary...

Web Admins Targeted in Phishing Attack

Scam e-mail artists have launched a massive campaign to trick webmasters into giving up the credentials needed to administer their Web sites, targeting site owners at more than 90 online hosting providers. Read the full article. Washington Post...

Twitter Warns About New Phishing Attack

Twitter warned on Wednesday about a new phishing attack in which direct messages to users link to a fake log-in page that steals passwords. “We’ve seen a few phishing attempts today; if you’ve received a strange direct message, and it takes you to a Twitter log-in page, don’t do it!” the Twitter...

Drupal SA-CONTRIB-2009-080: Simplenews Statistics Open Redirect

The version of Drupal running on the remote web server includes the third-party Simplenews Statistics module, which provides newsletter statistics such as open and click-through rates. The version of Simplenews Statistics installed contains an open redirect, which can be used in a phishing attack...

Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-821-1)

Several flaws were discovered in the Firefox browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-3070,...

USN-821-1: Firefox and Xulrunner vulnerabilities

Several flaws were discovered in the Firefox browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-3070,...

USN-811-1: Firefox and Xulrunner vulnerability

Juan Pablo Lopez Yacubian discovered that Firefox did not properly display invalid URLs. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. Furthermore, if the malicious website had a valid SSL...

Mozilla Firefox Multiple Memory Corruption Vulnerabilities Aug-09 (Linux)

This host is installed with Mozilla Firefox and is prone to multiple Memory Corruption vulnerabilities. OpenVAS Vulnerability Test $Id: gbfirefoxmultmemcrptnvulnaug09lin.nasl 4865 2016-12-28 16:16:43Z teissa $ Mozilla Firefox Multiple Memory Corruption Vulnerabilities Aug-09 Linux Authors: Sharat...

USN-779-1: Firefox and Xulrunner vulnerabilities

Several flaws were discovered in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-1392,...

Cisco Adaptive Security Appliance 8.x - Web VPN FTP or CIFS Authentication Form Phishing

Cisco Adaptive Security Appliance 8.x - Web VPN FTP or CIFS Authentication Form Phishing source: https://www.securityfocus.com/bid/35475/info Cisco Adaptive Security Appliance ASA is prone to a vulnerability that can aid in phishing attacks. An attacker can exploit this issue to display a fake...

Symantec Reporting Server Improper URL Handling Exposure

The remote host is running Symantec Reporting Server, a component of Symantec AntiVirus Corporate Edition, Symantec Client Security, and Symantec Endpoint Protection Manager that serves to create reports about the use of Symantec antivirus products in an enterprise environment. The installed...