CVE-2009-3784

Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2009-3784

CVE-2009-3784 corresponds to an open redirect flaw in the Simplenews Statistics Drupal module (6.x) prior to 6.x-2.0. The vulnerability allows remote attackers to redirect users to arbitrary websites, enabling phishing-style attacks via unspecified vectors. Affected product/label: Drupal module S...

'Avalanche' Crimeware Kit Fuels Phishing Attacks

A single cybercrime group called “Avalanche” was responsible for nearly one-quarter of all identity theft-related phishing attacks in the first half of 2009, according to a new report by the Anti-Phishing Work Group APWG. According to the report, phishing sites on Avalanche domains target the...

On the Outlook Web Access Attacks, Adobe and Microsoft Patch Releases

In this episode, Ryan and Dennis discuss the Outlook Web Access phishing attacks, the huge Microsoft and Adobe patch releases and the massive scope of the botnet problem. Download SHOW NOTES: Zeus Trojan Part of New Outlook Web Access Phishing Scam Microsoft Ships Largest Batch of Security Patche...

Cybercriminals Riding Money Mules in Online Bank Robberies

Over on the Washington Post’s SecurityFix blog, Brian Krebs has been doing a phenomenal job highlighting the online bank robberies — using malware — against small businesses in the United States. The latest installment, which looks at the role of “money mules” in the cybercrime operation is...

Code injection

Opera before 10.00 does not properly display all characters in Internationalized Domain Names IDN in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode...

CVE-2009-2196

Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors...

CVE-2009-2199

Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs...

Design/Logic Flaw

Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs...

CVE-2009-2196

Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors...

CVE-2009-2196

The provided data confirms CVE-2009-2196 affects Apple Safari before 4.0.3. The vulnerability is described as an unspecified issue that allows a remote web server to place an arbitrary website in Safari’s Top Sites view, potentially enabling phishing attacks via unknown vectors. Connected OpenVAS...

CVE-2009-2199

Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs...

CVE-2009-2199

Removed by vendor...

CVE-2009-2199

CVE-2009-2199 is an incomplete blacklist vulnerability in WebKit used by Apple Safari (and in iPhone OS up to 3.1/3.1.1) that allows remote attackers to spoof domain names in URLs via unspecified homoglyphs, potentially enabling phishing. The affected component is WebKit/Safari prior to version 4...

Design/Logic Flaw

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls th...

CVE-2009-2654

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls th...

Hackers Pounce on Michael Jackson's Death

As night follows day, malicious hackers are following high-profile news around celebrity deaths to launch attacks. According to a warning from the U.S. Computer Emergency Response team, there are several spam campaigns, phishing attacks, and malicious code targeting the recent deaths of Michael...

CVE-2009-2138

Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via 1 the returnto parameter to login.php or 2 the returnto parameter in a delete action to news.php. NOTE: this can be leveraged for cross-sit...

CVE-2009-2138

Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via 1 the returnto parameter to login.php or 2 the returnto parameter in a delete action to news.php. NOTE: this can be leveraged for cross-sit...

CVE-2009-2138

CVE-2009-2138 affects TBDev.NET 01-01-08 with multiple open redirect vulnerabilities. The issue allows remote attackers to redirect users to arbitrary sites via (1) the returnto parameter in login.php and (2) the returnto parameter in a delete action to news.php. This can be leveraged for phishin...