Internet Explorer窗口加载竞争条件地址栏欺骗漏洞(MS06-021)

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 配置Internet Explorer在运行活动脚本之前要求提示，或在Internet和本地intranet安全区中禁用活动脚本。 将Internet和本地intranet安全区设置为“高”以在运行ActiveX控件和活动脚本之前要求提示。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS06-021）以及相应补丁: MS06-021：Cumulative Security Update for Internet Explorer 916281...

Microsoft XML核心服务信息泄露漏洞（MS06-061）

Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft XML核心服务中的XMLHTTP ActiveX控件没有正确地解析HTTP服务器端重定向，远程攻击者可能利用此漏洞非授权访问用户信息。 攻击者可以通过构建特制网页来利用此漏洞，如果用户访问该网页或单击特制电子邮件中的链接，就可能导致信息泄露。成功利用这个漏洞的攻击者可能以在客户端浏览Web用户的权限访问其他域的内容。不过，要利用此漏洞，需要进行用户交互。 Microsoft Office 2003 Service Pack 2 Microsoft Office 2003 Service Pack 1...

We do not pay much attention to the super command! - Vulnerability warning-the black bar safety net

View the system uptime: In the CMD the following input: systeminfo CMD interface to modify In the CMD the following input: prompt hack Defense Run the Add/Remove Programs In the CMD the following to enter: appwiz. cpl Run the INternet properties: In the CMD the following to enter: inetcpl. cpl 当然...

VBS script in system security in eight the clever application-vulnerability warning-the black bar safety net

VBS script virus a large number of popular brings us to the VBS function with a new understanding, now everyone on the it also began to pay attention to it. VBS code in local is by the Windows Script HostWSHinterpreter execution. VBS script to perform without the WSH, the WSH is Microsoft offers ...

Hidden system accounts Madona-vulnerability warning-the black bar safety net

When hacking a host, will find ways to protect their“fruits of Labor”, and therefore in the broiler on the left all sorts of backdoors for a long time was the control broiler,of which the most used is the account hidden technique. In broilers on the establishment of a hidden account, to prepare f...

RealVNC Server does not validate client authentication method

Overview The RealVNC Server fails to properly authenticate clients. This may allow a remote attacker to bypass authentication and gain access to the VNC server. Description TheVirtual Network ComputingVNC Protocol According to RealVNC, "The VNC protocol is a simple protocol for remote access to...

DEBIAN-CVE-2006-2366

ircpio.c in libopenobex for ircp 1.2, when ircp is run with the -r option, does not prompt the user when overwriting files, which allows user-assisted remote attackers to overwrite dangerous files via an arbitrary destination file name in an OBEX File Transfer session...

ietest.html.txt

This is a multi-part message in MIME format. --------------010404020600030408080408 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Dear Lists: Apparently I wasn't clear enough with this paragraph of my advisory, or a...

Microsoft“blocked”online update our“hack”to have surgery-vulnerability warning-the black bar safety net

The Microsoft Windows System vulnerability frequently, in order for the majority of users“responsible for”, Microsoft provide website, online patch update. Who want to make their computer more secure some? Thus are pleased to accept this“free lunch.” But recently found that the update is...

[Full-disclosure] Cpanel Admin login (username) Disclosure

Hi, could somebody kindly confirm this. When a null username and a null password is provided in the cpanel administration, port 2082, basic authorization prompt and then cancelling the prompt the second time, the webpage presents a hyperlink to reset the password which contains valid username for...

Winamp fails to properly handle playlists with long "file" parameter

Overview Winamp contains a buffer overflow vulnerability when processing a playlist that has a long file parameter. This may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Winamp Winamp is a media player for Microsoft Windows systems. It can...

See me for the privilege with a vulnerability to enhance computer control-vulnerability warning-the black bar safety net

Allegedly Windows COM structure there is a security problem, the local orremote attackcan use this vulnerability to elevate privileges or execute arbitrary instructions. AffectedOSand procedures when processing COM structured storage file, the access to the shared memory exists in the way that...

CVE-2005-2927: Undefined Security Weakness

Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary code via a long argument to the 1 prompt or 2 defprompt command...

SimplePHPBlog Arbitrary File Deletion and Sample Exploit

SimplePHPBlog has a vulnerability in its commentdeletecgi.php. The PHP script allows for the arbitrary deletion of files. Please see following link for a perl script to demonstrate the exploit: http://www.ftusecurity.com/pub/sphpblogvulns Please add .pl extension as my ISP server preprocesses the...

[Full-disclosure] Privilege escalation in Linksys WLAN Monitor v2.0.

Summary: Privilege escalation in Linksys WLAN Monitor v2.0 http://www.linksys.com/ Details: The Linksys WLAN Monitor service WLSVC that is used to configure settings for various Linksys wireless network cards runs under the context of the LocalSystem account. It is possible to manipulate the...

USN-155-1: Mozilla vulnerabilities

Secunia.com reported that one of the recent security patches in Firefox reintroduced the frame injection patch that was originally known as CAN-2004-0718. This allowed a malicious web site to spoof the contents of other web sites. CAN-2005-1937 It was discovered that a malicious website could...

USN-149-1: Firefox vulnerabilities

Secunia.com reported that one of the recent security patches in Firefox reintroduced the frame injection patch that was originally known as CAN-2004-0718. This allowed a malicious web site to spoof the contents of other web sites. CAN-2005-1937 In several places the browser user interface did not...

Javascript prompt origin spoofing — Mozilla

Alerts and prompts created by scripts in web pages are presented with the generic title JavaScript Application which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract...

Apple Safari automatically installs Dashboard widgets

Overview Apple Safari on Mac OS X Tiger automatically installs Dashboard widgets without user intervention or notice. Description DashboardDashboard is a new feature introduced in Apple Mac OS X Tiger 10.4. Dashboard is a collection of applications called "widgets." The system-installed widgets a...

Critical: Red Hat Security Advisory: firefox security update

Updated firefox packages that fix various bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. A bug was found in the Firefox string handling functions. If a malicious website is...