Symantec Reporting Server Improper URL Handling Exposure

SUMMARY The login web page in some versions of Symantec Reporting Server contains a URL handling error which could potentially allow an attacker to launch a phishing attack. AFFECTED PRODUCTS Product | Affected Version | Solution ---|---|--- Symantec AntiVirus Corporate Edition | 10.1 MR7 and...

USN-764-1: Firefox and Xulrunner vulnerabilities

Several flaws were discovered in the browser engine. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-1302, CVE-2009-1303, CVE-2009-1304,...

Ubuntu USN-728-1 (xulrunner-1.9)

The remote host is missing an update to xulrunner-1.9 announced via advisory USN-728-1. OpenVAS Vulnerability Test $Id: ubuntu7281.nasl 7969 2017-12-01 09:23:16Z santu $ $Id: ubuntu7281.nasl 7969 2017-12-01 09:23:16Z santu $ Description: Auto-generated from advisory USN-728-1 xulrunner-1.9 Author...

CVE-2009-0777

CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...

Information disclosure

An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing...

Information disclosure

An unspecified function in the JavaScript implementation in Microsoft Internet Explorer creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session...

CVE-2008-5912

An unspecified function in the JavaScript implementation in Microsoft Internet Explorer creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session...

CVE-2008-5915

CVE-2008-5915 concerns Google Chrome’s JavaScript implementation where an unspecified function creates and exposes a 'temporary footprint' during an active login, enabling in-session phishing via spoofed pop-ups. The sources describe the issue but provide no actionable details (no disclosure of f...

CVE-2008-5913

CVE-2008-5913 affects Mozilla Firefox 3.5.x before 3.5.10 and Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, where the JavaScript Math.random RNG is seeded only once per browser session. This enables in-session tracking and user-targeted phishing via spoofed pop-ups. The vulnerability is...

CVE-2008-5913

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a...

CVE-2008-5913

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a...

Design/Logic Flaw

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks...

PYSEC-2008-7

Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors...

CVE-2008-5117

Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

UC Gateway Investment SiteEngine 5.0 - api.php Open Redirection

UC Gateway Investment SiteEngine 5.0 - api.php Open Redirection source: https://www.securityfocus.com/bid/31888/info SiteEngine is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing-style...

CVE-2008-3061

Open redirect vulnerability in redirect.php in V-webmail 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the to parameter...

CVE-2008-4162

CVE-2008-4162 describes an open redirect in NooMS 1.1, exploitable through admin/auth.php via the g_site_url parameter to redirect users to arbitrary sites, enabling phishing. The affected software is NooMS 1.1; the vulnerability is tied to improper handling of g_site_url leading to user redirect...

Microsoft IE 7 popup window address bar URI spoofing vulnerability-vulnerability warning-the black bar safety net

| Affected versions: Microsoft Internet Explorer 7.0 --- Description: BUGTRAQ ID: 2 8 4 9 8 Internet Explorer is Microsoft's release of the very popular WEB browser. If the user use IE to visit a malicious Web page while the pop-up window's address bar may be any address and the window theme to a...

Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.13版本修复多个安全漏洞

BUGTRAQ ID: 28448 CVECAN ID: CVE-2008-1241,CVE-2008-1240,CVE-2007-4879,CVE-2008-1238,CVE-2008-1236,CVE-2008-1237,CVE-2008-1233,CVE-2008-1234,CVE-2008-1235 Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。...

Two XSS on Blue Coat ProxySG Management Console

PR07-29: Two XSS on Blue Coat ProxySG Management Console Vulnerability found: 23 July 2007 Vendor informed: 20 August 2007 Vulnerability fixed: 29 October 2007 Advisory publicly released: 1 November 2007 Severity: Medium Description: Blue Coat SG400 is vulnerable to a couple of XSS holes...