Simply Sites RGV Local File Inclusion

Title : Simply Sites RGV Local File Inclusion Author: DevilZ TM Data : 2010-04-01 InformatioN Title : Simply Sites RGV Local File Inclusion Author : DevilZ TM By D3v1l Homepage : http://www.DEVILZTM.com Email : [email protected] Contact : [email protected] ExploiT Vulnerable File :...

Simply Sites RGV - Local File Inclusion

Title : Simply Sites RGV Local File Inclusion Author: DevilZ TM Data : 2010-04-01 InformatioN Title : Simply Sites RGV Local File Inclusion Author : DevilZ TM By D3v1l Homepage : http://www.DEVILZTM.com Email : [email protected] Contact : [email protected] ExploiT Vulnerable File :...

XSLT can be used to retrieve random contents of unrelated documents – Opera Security Advisories

XSLT can be used to retrieve random contents of unrelated documents – Opera Security Advisories OPCOM Team | March 18, 2010 Affected versions This vulnerability affects Opera 10.50. Severity Highly severe Description XSLT is normally subject to strict controls, preventing documents from separate...

XSLT can be used to retrieve random contents of unrelated documents

XSLT is normally subject to strict controls, preventing documents from separate Web sites from reading the contents of other sites. Certain XSLT constructs can cause Opera to retrieve the wrong contents for the resulting document. These contents will appear randomly from the cached versions of an...

Design/Logic Flaw

Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a prox...

Chrome Password Manager Cross Origin Weakness (CVE-2010-0556)

Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Chrome Password Manager Cross Origin Weakness Release Date: 2010-02-15 Application: Google Chrome Web Browser Versions:...

Zeus Trojan Attacking NSA, .gov Sites

Criminals are spamming the Zeus banking Trojan in a convincing e-mail that spoofs the National Security Agency. Initial reports indicate that a large number of government systems may have been compromised by the attack. Read the full article. KrebsonSecurity...

Attackers Targeting .Edu Sites in SEO Poisoning Campaigns

Having mastered the art of poisoning search engine results for .com sites, attackers are now turning their attention to .edu sites, linking their keyword campaigns to educational institutions as a way of lending their malicious sites more credence in the eyes of Google. The goal of these attacks ...

Network Solutions' Customers Hacked, Defaced

Web site domain registrar and hosting provider Network Solutions acknowledged that hackers had broken into its servers and defaced hundreds of customer Web sites. The hackers appear to have replaced each site’s home page with anti-Israeli sentiments and pictures of masked militants and armed with...

Google Attackers Used Internet Explorer Zero Day

Several of the companies victimized in the attack that hit Google and dozens of other companies recently were compromised through the use of a new, unpatched vulnerability in Internet Explorer, experts say. The flaw was used in a sophisticated attack that included victims receiving targeted email...

OpenJDK: Improper parsing of crossdomain.xml files (intended access restriction bypass) (6798948)

The Java Plug-in in Java SE Development Kit JDK and Java Runtime Environment JRE 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948...

OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lack...

Amazon, Wal-Mart Smacked By DDoS Attacks

If you’ve been doing some last minute Amazon holiday shopping on Wednesday evening, you’ve probably noticed that Amazon’s web site was sluggish and, at times, completely down; The same fate greeted Wal-Mart, Expedia, and a number of smaller sites. Read the full article. Mashable...

OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lack...

Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : kdelibs vulnerabilities (USN-871-1)

A buffer overflow was found in the KDE libraries when converting a string to a floating point number. If a user or application linked against kdelibs were tricked into processing crafted input, an attacker could cause a denial of service via application crash or possibly execute arbitrary code wi...

Web Shopping Sites Get Independent Testing

U-Test has just completed a substantive, independent review of three major e-tailing sites–Amazon, Walmart and Target– and found a gaping cross-site scripting security hole in one of them. Read the full article. The Last Watchdog...

Microsoft Internet Explorer 'XSS Filter' XSS Vulnerabilities (Nov 2009)

Internet Explorer is prone to a cross-site scripting XSS vulnerability. This VT has been deprecated and replaced by the VT with the OID: 1.3.6.1.4.1.25623.1.0.901097. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

CVE-2009-4074

The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the "response-changing mechanism" to conduct cross-site scripting XSS attacks against web sites that have no inherent XSS vulnerabilities, related to the details of output encoding and improper modification of an...

Error messages can leak onto unrelated sites – Opera Security Advisories

Scripting error messages are normally available only to the page that caused the error. In some cases, the error messages could be passed to other sites as the contents of unrelated variables, and may contain sensitive information. If those sites write the content into the page markup, this could...

CVE-2009-2841

The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attacke...