Code injection

WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name IDN support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" homographs and possibly perform...

CVE-2007-3742

This CVE-2007-3742 entry describes a URL spoofing flaw in WebKit used by Apple Safari 3 Beta (before Update 3.0.3) and iPhone (before 1.0.1). The root cause is the interaction between International Domain Name (IDN) support and Unicode fonts, which can allow remote attackers to craft a URL contai...

CVE-2007-4018

Citrix Access Gateway Advanced Edition before firmware 4.5.5 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors...

CVE-2007-4018

Citrix Access Gateway Advanced Edition before firmware 4.5.5 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors...

CVE-2007-4018

The CVE concerns Citrix Access Gateway Advanced Edition prior to firmware 4.5.5. The vulnerability allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors. The Connected documents do not provide concrete exploit details, affected versions beyond ...

PR07-21: Webbler CMS forms are susceptible to spamming and phishing abuses

PR07-21: Webbler CMS forms are susceptible to spamming and phishing abuses This advisory has been published following consultation with UK CPNI formerly known as NISCC Date Found: 14th June 2007 Successfully tested on: Webbler CMS version 3.1.3. Earlier versions are possibly affected as well. Not...

CVE-2007-2398

Apple Safari 3.0.1 beta 522.12.12 on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout to create an event that modifies the window content, which could facilitate phishin...

Code injection

Apple Safari 3.0.1 beta 522.12.12 on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout to create an event that modifies the window content, which could facilitate phishin...

CVE-2007-2398

CVE-2007-2398 concerns Apple Safari 3.0.1 beta (522.12.12) on Windows. The flaw allows remote attackers to spoof the window title and address bar by manipulating the location bar and using setTimeout() to trigger an event that changes the main window content, potentially enabling phishing. This i...

[SECURITY] [DSA 1306-1] New xulrunner packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1306-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 12th, 2007 http://www.debian.org/security/faq -...

CVE-2007-3164

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if t...

Authentication flaw

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if t...

CVE-2007-3164

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if t...

Design/Logic Flaw

Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication...

CVE-2007-3142

Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication...

CVE-2007-3144

Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication...

CVE-2007-3145

Visual truncation vulnerability in Galeon 2.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication...

Design/Logic Flaw

Visual truncation vulnerability in Galeon 2.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication...

Design/Logic Flaw

Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication...

Design/Logic Flaw

Visual truncation vulnerability in Konqueror 3.5.5 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication...