pam_captcha username harvest vulnerability

pamcaptcha is visual text-based CAPTCHA challenge module for PAM that uses figlet to generate the CAPTCHAs. Project site: http://www.semicomplete.com/projects/pamcaptcha/ A site with a screen shot: http://www.michaelboman.org/how-to/securing-ssh-access-with-pam-captcha I found a security problem...

Microsoft IE未初始化内存远程代码执行漏洞（MS10-035）

BUGTRAQ ID: 40410 CVE ID: CVE-2010-1259 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 Internet Explorer访问尚未正确初始化对象的方式中存在一个远程执行代码漏洞。攻击者可以通过构建特制的网页来利用该漏洞，当用户查看网页时，该漏洞可能允许远程执行代码。成功利用此漏洞的攻击者可以获得与登录用户相同的用户权限。如果用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。 Microsoft Internet Explorer 8.0 Microsoft Internet Explor...

Privacy — Handling Cookies

US-CERT recommends that you select the Advanced button and select Override automatic cookie handling. Then select Prompt for both first and third-party cookies. This will prompt you each time a site tries to place a cookie on your machine. If the number of cookie prompts is too excessive, the...

Apple Safari 4.0.5 - parent.close() Memory Corruption Code Execution

Apple Safari 4.0.5 - parent.close Memory Corruption Code Execution Tested on: Apple Safari 4.0.5 / XP SP2 Polish Shellcode: Windows Execute Command calc Local: Yes Remote: Yes POPUP must be enabled Ctrl+Shift+K Just for fun ; -- window.open"0day.htm"; //parent.close activation self.close;...

Apple Safari 4.0.5 parent.close() (memory corruption) Code Execution

Exploit for windows platform in category remote exploits ==================================================================== Apple Safari 4.0.5 parent.close memory corruption Code Execution ==================================================================== Tested on: Apple Safari 4.0.5 / XP SP...

MS Offers SharePoint Zero Day Workaround

Microsoft offered an interim work-around for a SharePoint bug that involved disabling access to the help system by running a pair of commands from the command prompt. The commands modify the access control list ACL, Windows’ list of file access permissions. Read the full article. Computerworld...

Mandriva Update for firefox MDVSA-2010:070-1 (firefox)

Check for the Version of firefox OpenVAS Vulnerability Test Mandriva Update for firefox MDVSA-2010:070-1 firefox Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mandriva Update for firefox MDVSA-2010:070 (firefox)

Check for the Version of firefox OpenVAS Vulnerability Test Mandriva Update for firefox MDVSA-2010:070 firefox Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

RedHat Update for pam_krb5 RHSA-2010:0258-04

Check for the Version of pamkrb5 OpenVAS Vulnerability Test RedHat Update for pamkrb5 RHSA-2010:0258-04 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Mozilla Foundation Security Advisory 2010-15

Mozilla Foundation Security Advisory 2010-15 Title: Asynchronous Auth Prompt attaches to wrong window Impact: Low Announced: March 23, 2010 Reporter: Justin Dolske Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Mozilla developer Justin Dolske reported that the new asynchronous...

pam_krb5 security and bug fix update

2.2.14-15 - update backport for selecting which key to use for validation so that it prefers services with the local host name as the instance, from HEAD more of 450776 2.2.14-14 - backport the 'multipleccaches' option from HEAD, requiring that it be enabled to not immediately remove an old ccach...

Mozilla Products Multiple Vulnerabilities Mar-10 (Windows)

The host is installed with Mozilla Firefox/Seamonkey/Thunderbird and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodmozillaprdtsmultvulnmar10win.nasl 6444 2017-06-27 11:24:02Z santu $ Mozilla Products Multiple Vulnerabilities Mar-10 Windows Authors: Antu Sanadi...

Low: Red Hat Security Advisory: pam_krb5 security and bug fix update

Updated pamkrb5 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2010-0172: Undefined Security Weakness

toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorizati...

Asynchronous Auth Prompt attaches to wrong window — Mozilla

Mozilla developer Justin Dolske reported that the new asynchronous Authorization Prompt HTTP username and password was not always attached to the correct window. Although we have not demonstrated this, it may be possible for a malicious page to convince a user to open a new tab or popup to a...

Mozilla Firefox 3.6.x < 3.6.2 Multiple Vulnerabilities

Binary data 5485.prm...

Mozilla Firefox < 3.6.2 Multiple Vulnerabilities.

The remote host is running a version of Mozilla Firefox 3.6.x earlier than 3.6.2. Such versions are potentially affected by multiple security issues : - The WOFF decoder contains an integer overflow in a font decrompression routine. MFSA 2010-08 - Deleted image frames are reused when handling...

CVE-2010-0706: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the login/prompt component in Subex Nikira Fraud Management System allows remote attackers to inject arbitrary web script or HTML via the message parameter...

CVE-2010-0556

browser/login/loginprompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Password Manager for a different web site, which allows user-assisted remote HTTP servers to obtain sensitive information via a URL that requires authentication,...

Microsoft IE基线标签渲染远程代码执行漏洞（MS10-002）

BUGTRAQ ID: 37895 CVE ID: CVE-2010-0245 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 如果交错的strike和center标签中包含用用于操控sub或sup等字体基线的元素的话，则在IE渲染该标签时存在释放后使用错误。在删除这个元素指针的时候，IE之后会引用已被释放的指针。 攻击者可以通过构建特制的网页来利用该漏洞，当用户查看网页时，该漏洞可能允许远程执行代码。 Microsoft Internet Explorer 8.0 临时解决方法： 将Internet...