FreeBSD : mozilla -- arbitrary code execution vulnerability (cbfde1cd-87eb-11d9-aa18-0001020eed82)

A Mozilla Foundation Security Advisory reports : Plugins such as flash can be used to load privileged content into a frame. Once loaded various spoofs can be applied to get the user to interact with the privileged content. Michael Krax's 'Fireflashing' example demonstrates that an attacker can op...

CVE-2005-2146

SSH Tectia Server 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, uses insecure permissions when generating the Secure Shell host identification key, which allows local users to access the key and spoof the server...

CVE-2005-2060

Multiple HTTP Response Splitting vulnerabilities in 1 toggleshow.php, 2 togglecats.php, and 3 showprofile.php in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the Cat parameter...

CVE-2002-1937

Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration, which allows remote attackers to spoof the administrator's MAC address and perform an ARP poisoning man-in-the-middle attack to obtain the administrator's password...

Sudo symbolic links race condition

If sudoers file contains specific records, race conditions exist to spoof command with symlink...

CVE-2005-1214

Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page...

CVE-2005-1794

Microsoft Terminal Server using Remote Desktop Protocol RDP 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks...

myPHP Forum v3 (possible v1 & 2 also) Identification 'spoof'

PHOX: myPHP v3 Final 'Sender/Poster Exploit' Content - Credits - 'sploit - Solution Credits Exploit discovered by Phox/Terencentanio/Phoxpherus of Root32. Email: [email protected] / [email protected] 'sploit There are two exploits here. 1. Posting as someone else. It's...

CVE-2001-0163

Cisco AP340 base station is affected by CVE-2001-0163, which causes predictable TCP Initial Sequence Numbers (ISNs) enabling a attacker to spoof or hijack TCP connections. The vulnerability is described across CVE records and corroborated by Nessus (TCP/IP Predictable ISN). The available document...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is the next-generation mail client from the Mozilla project. Description The following vulnerabilities were found and fixed in Mozilla Thunderbird: Mark Dowd from ISS X-Force reported an exploitable heap overrun in the GIF processing of obsolete Netscape extension 2...

security flaw

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content...

CVE-2005-0593

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via 1 a web site that does not finish loading, which shows the lock of the previous site, 2 a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake ...

CVE-2005-0238

The International Domain Name IDN support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks...

CVE-2004-2219

Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake...

CVE-2004-1158

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka t...

CVE-2004-0845

Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site...

Mozilla Firefox < 3.0.11 Multiple Vulnerabilities

Binary data 5072.prm...

eudora61.pl

Eudora 6.1 on Windows is evil - have tested "Light Mode" free only so far, do not know if "Sponsored Mode" or "Paid Mode" would be any different. Do not use: stay away from Eudora, or maybe use version 6.0.3. --- Attachment spoof, LaunchProtect:...

Sphera HostingDirector 1.02.03.0 - VDS Control Panel Account Configuration Modification

Sphera HostingDirector 1.02.03.0 - VDS Control Panel Account Configuration Modification source: https://www.securityfocus.com/bid/7896/info Sphera HostingDirector VDS Control Panel has been reported prone to a vulnerability where an attacker may make arbitrary account configuration modifications...

Eudora 5.2.1 buffer overflow DoS

Building on my Eudora attachment spoof http://www.securityfocus.com/archive/1/322286 I notice that sending a filename with many dots crashes Eudora, e.g. From: me To: you Attachment ConvertedCR: "B.A.A.A ... .A.A.A" with 122 repetitions of ".A" make it crash, writing an Exception.log file. Fewer...