Information disclosure

An unspecified function in the JavaScript implementation in Microsoft Internet Explorer creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session...

Information disclosure

An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing...

CVE-2008-5912

An unspecified function in the JavaScript implementation in Microsoft Internet Explorer creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session...

CVE-2008-5915

CVE-2008-5915 concerns Google Chrome’s JavaScript implementation where an unspecified function creates and exposes a 'temporary footprint' during an active login, enabling in-session phishing via spoofed pop-ups. The sources describe the issue but provide no actionable details (no disclosure of f...

CVE-2008-5913

CVE-2008-5913 affects Mozilla Firefox 3.5.x before 3.5.10 and Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, where the JavaScript Math.random RNG is seeded only once per browser session. This enables in-session tracking and user-targeted phishing via spoofed pop-ups. The vulnerability is...

CVE-2008-5913

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a...

CVE-2008-5913

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a...

Design/Logic Flaw

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks...

PYSEC-2008-7

Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors...

CVE-2008-5117

Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

UC Gateway Investment SiteEngine 5.0 - api.php Open Redirection

UC Gateway Investment SiteEngine 5.0 - api.php Open Redirection source: https://www.securityfocus.com/bid/31888/info SiteEngine is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing-style...

CVE-2008-3061

Open redirect vulnerability in redirect.php in V-webmail 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the to parameter...

CVE-2008-4162

CVE-2008-4162 describes an open redirect in NooMS 1.1, exploitable through admin/auth.php via the g_site_url parameter to redirect users to arbitrary sites, enabling phishing. The affected software is NooMS 1.1; the vulnerability is tied to improper handling of g_site_url leading to user redirect...

Microsoft IE 7 popup window address bar URI spoofing vulnerability-vulnerability warning-the black bar safety net

| Affected versions: Microsoft Internet Explorer 7.0 --- Description: BUGTRAQ ID: 2 8 4 9 8 Internet Explorer is Microsoft's release of the very popular WEB browser. If the user use IE to visit a malicious Web page while the pop-up window's address bar may be any address and the window theme to a...

Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.13版本修复多个安全漏洞

BUGTRAQ ID: 28448 CVECAN ID: CVE-2008-1241,CVE-2008-1240,CVE-2007-4879,CVE-2008-1238,CVE-2008-1236,CVE-2008-1237,CVE-2008-1233,CVE-2008-1234,CVE-2008-1235 Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。...

SEC Consult SA-20071101-0 :: Multiple Vulnerabilities in SonicWALL SSL-VPN Client

SEC Consult Security Advisory 20071101-0 ===================================================================================== title: Multiple vulnerabilities in SonicWALL SSL-VPN Client Deletion of arbitrary files on the client Arbitrary code execution thru various buffer overflows program:...

Two XSS on Blue Coat ProxySG Management Console

PR07-29: Two XSS on Blue Coat ProxySG Management Console Vulnerability found: 23 July 2007 Vendor informed: 20 August 2007 Vulnerability fixed: 29 October 2007 Advisory publicly released: 1 November 2007 Severity: Medium Description: Blue Coat SG400 is vulnerable to a couple of XSS holes...

security flaw

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers to conduct phishing and spoofing attacks by setting the hidechrome attribute...

phpnukesearch-xss.txt

PHP-Nuke ALL versions Search Module multiple XSS and HTML injection ------------------------------------------------------------------- The well-known PHP-Nuke CMS is vulnerable to multiple XSS attacks and HTML injections through the Search Module. The request is made using POST, but the whole...

Improvements to help protect against Cross-Site Scripting attacks — Mozilla

Firefox 2.0.0.2 and 1.5.0.10 contain several small changes that will make it easier for sites to protect their visitors against Cross-Site Scripting XSS attacks. Invalid trailing characters in HTML tag attributes The Mozilla parser formerly ignored invalid trailing characters in HTML tag attribut...