CVE-2010-2274

Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to...

CVE-2010-1384

The CVE-2010-1384 entry concerns Safari’s address bar spoofing vulnerability. Affected products include Safari before 5.0 on Mac OS X 10.5–10.6 and Windows, and before 4.1 on Mac OS X 10.4. The underlying issue is that the URL displayed in the address bar can be spoofed, making the user believe t...

FreeBSD Ports: mediawiki

The remote host is missing an update to the system as announced in the referenced advisory. VID 694da5b4-5877-11df-8d80-0015587e2cc1 OpenVAS Vulnerability Test $ Description: Auto generated from VID 694da5b4-5877-11df-8d80-0015587e2cc1 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

mediawiki -- authenticated CSRF vulnerability

A MediaWiki security announcement reports: MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with...

CVE-2010-0715

CVE-2010-0715 is an open redirect vulnerability in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management, covering versions 5.1.0.0–5.1.0.5, 6.0.0.0–6.0.0.4, 6.0.1.0–6.0.1.7, 6.1.0.0–6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8....

Twitter Hit By Phishing Attack

Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts. Read the full article. The Register...

Chrome Password Manager Cross Origin Weakness (CVE-2010-0556)

Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Chrome Password Manager Cross Origin Weakness Release Date: 2010-02-15 Application: Google Chrome Web Browser Versions:...

Comerica Bank Sued for Failed 2-Factor Authentication

A metals supply company in Michigan is suing its bank for poor security practices after a successful phishing attack against an employee allowed thieves to steal more than half a million dollars last year. Read the full article. KrebsonSecurity...

Google Attack Was Tip of the Iceberg

The recent disclosure by Google, Adobe and other companies that their networks had been thoroughly compromised by attackers who may have been after their source code has prompted a tremendous amount of discourse both in the security community and in the general public about the political and...

PR09-15: XSS injection vulnerability within HP System Management Homepage (Insight Manager)

PR09-15: XSS injection vulnerability within HP System Management Homepage Insight Manager Vulnerability found: 11th October 2009 Severity: Medium Description: A XSS vulnerability has been found within HP System Management; Arising from insufficient input filtering. By using a specially-crafted...

SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection

Exploit Title: Silverstripe = 2.3.5 Cross Site Request Forgery & Open Redirection. Date: 12/01/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Vendor: www.silverstripe.org | Version: 2.0.0 Tested on: PHP Open Redirection: OWASP: An open redirect is an application that...

USN-878-1: Firefox 3.5 and Xulrunner 1.9.1 regression

USN-874-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream changes introduced a regression when using NTLM authentication. This update fixes the problem and adds additional stability fixes. We apologize for the inconvenience. Original advisory details: Jesse Ruderman, Josh Soref,...

Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-873-1)

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary...

USN-874-1: Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary...

Web Admins Targeted in Phishing Attack

Scam e-mail artists have launched a massive campaign to trick webmasters into giving up the credentials needed to administer their Web sites, targeting site owners at more than 90 online hosting providers. Read the full article. Washington Post...

Twitter Warns About New Phishing Attack

Twitter warned on Wednesday about a new phishing attack in which direct messages to users link to a fake log-in page that steals passwords. “We’ve seen a few phishing attempts today; if you’ve received a strange direct message, and it takes you to a Twitter log-in page, don’t do it!” the Twitter...

Drupal SA-CONTRIB-2009-080: Simplenews Statistics Open Redirect

The version of Drupal running on the remote web server includes the third-party Simplenews Statistics module, which provides newsletter statistics such as open and click-through rates. The version of Simplenews Statistics installed contains an open redirect, which can be used in a phishing attack...

Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-821-1)

Several flaws were discovered in the Firefox browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-3070,...

USN-821-1: Firefox and Xulrunner vulnerabilities

Several flaws were discovered in the Firefox browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-3070,...

USN-811-1: Firefox and Xulrunner vulnerability

Juan Pablo Lopez Yacubian discovered that Firefox did not properly display invalid URLs. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. Furthermore, if the malicious website had a valid SSL...