CVE-2009-2196

Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors...

CVE-2009-2196

Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors...

CVE-2009-2196

The provided data confirms CVE-2009-2196 affects Apple Safari before 4.0.3. The vulnerability is described as an unspecified issue that allows a remote web server to place an arbitrary website in Safari’s Top Sites view, potentially enabling phishing attacks via unknown vectors. Connected OpenVAS...

Hijacking Safari 4 Top Sites

This short video demonstration shows a new technique for exploiting a flaw in Apple Safari 4 that enables an attacker to hijack the Top Sites feature in Safari and replace the victim’s Top Sites with phishing sites. The vulnerability and attack were discovered by Inferno...

HPSBPI02463 SSRT090061 rev.2 - HP LaserJet Printers, HP Color LaserJet Printers, Remote Cross Site Scripting (XSS)

Potential Security Impact Remote Cross Site Scripting XSS VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with certain HP LaserJet printers, HP Color LaserJet printers and HP Digital Senders. The vulnerabilities could be exploited remotely by Cross Site Scripting XSS...

Safari < 4.0.3 Multiple Vulnerabilities

The version of Safari installed on the remote Windows host is earlier than 4.0.3. Such versions are potentially affected by several issues : - A buffer overflow exists in the handling of EXIF metadata that ccould lead to a crash or arbitrary code execution. CVE-2009-2188 - A vulnerability in...

Safari < 4.0.3 Multiple Vulnerabilities

Binary data 5125.prm...

openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1161)

The Sun Java JRE /JDK 6 was updated to Update 15 fixing various security issues. CVE-2009-2670: The audio system in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by 1 untrusted apple...

Nate Lawson: Crypto Strikes Back!

This Google Tech Talk features researcher Nate Lawson discussing recent vulnerabilities in crypto libraries, why public key cryptography is like a Ford Pinto in a demolition derby and the password-hashing mess created by Web 2.0 sites...

OpenJDK proxy mechanism allows non-authorized socket connections (6801497)

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unspecified vectors, related to a declaration that lack...

Update Protection against Joomla! HTTP Header Script Injection

Joomla! is a content management system CMS designed for building Web sites and online applications. Joomla! fails to parse HTTP headers, allowing an attacker to inject JavaScript or DHTML code that can be executed in the context of a target user browser...

Sql injection

SQL injection vulnerability in content.php in Scripts For Sites SFS EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter...

CVE-2008-6867

SQL injection vulnerability in content.php in Scripts For Sites SFS EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter...

CVE-2008-6867

SQL injection vulnerability in content.php in Scripts For Sites SFS EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter...

The Microsoft MsVidCtl Video Control Flaw Explained

From Websense Security Labs The recently publicized Zero-Day Vulnerability in Microsoft DirectShow is in the wild and spreads through infection of thousands of legitimate Web sites. The proof-of-concept of the vulnerability is out and exploitation is very easy to achieve. In our labs we have been...

MyDoom DDoS Attacks Likely Work of Unsophisticated Attackers

The ongoing DDoS attacks that have been targeting a series of U.S. government sites as well as some commercial sites is likely not the work of any government organization and is being executed by an old piece of malware that is designed to ruin files on infected PCs rather than steal data, expert...

Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption

This module exploits a memory corruption within the MSVidCtl component of Microsoft DirectShow BDATuner.MPEG2TuneRequest. By loading a specially crafted GIF file, an attacker can overrun a buffer and execute arbitrary code. ClassID is now configurable via an advanced option otherwise randomized -...

CVE-2009-2383

SQL injection vulnerability in BTERWwebajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter...

Sql injection

SQL injection vulnerability in BTERWwebajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter...

CVE-2009-2383

The CVE-2009-2383 entry concerns the WordPress Related Sites plugin (version 2.1) and its BTE_RW_webajax.php component, where a blind SQL injection vulnerability exists via the guid parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands, as the parameter is not pro...