Flock Address Bar Spoofing Vulnerability - Linux

Flock Browser is prone to Address Bar Spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containi...

Design/Logic Flaw

Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site...

CVE-2009-3004

Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the sit...

CVE-2009-3006

Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site...

CVE-2009-3003

Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the...

CVE-2009-3006

The CVE-2009-3006 entry concerns Maxthon Browser 2.5.3.80 UNICODE. The vulnerability allows a remote attacker to spoof the address bar by using window.open with a relative URI, causing the browser to display an arbitrary URL on the site visited by the victim and potentially trigger a spoofed logi...

DNS BailiWicked Host Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random hostname queries to the target DNS server coupled with spoofed replies to those...

firefox/nss: doesn't handle NULL in Common Name properly

Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...

Researchers Reveal Fundamental SMS Flaws at Black Hat

There are several architectural and implementation problems in mobile phone networks that can be used to force users to open malicious files, allow attackers to gain control of users’ phones and change phone settings to redirect mobile Internet traffic to a proxy controlled by the attackers. In a...

New Flaw in Firefox Could Enable Phishing Attacks

There is a new vulnerability in Firefox that enables an attacker to open a new tab in a victim’s browser with a spoofed URL. The vulnerability is found in all current versions of Firefox and Mozilla does not have a patch for the problem yet. The vulnerability would be useful for attackers in a...

DNS BailiWicked Domain Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit replaces the target domains nameserver entries in a vulnerable DNS cache server. This attack works by sending random hostname queries to the target DNS server coupled...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-2381

Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate...

aMSN SSL Certificate Vulnerability

aMSN SSL Certificate Vulnerability I. The Vulnerability aMSN does not check SSL certificate before sending MSN user credentials. An attacker is able to obtain MSN username and password with a spoofed certificate and no alert is generated to the user. This vulnerability was found in aMSN 0.97.2...

Gizmo SSL Certificate Vulnerability

Gizmo SSL Certificate Vulnerability I. The Vulnerability Gizmo does not check SSL certificate before sending user credentials. An attacker is able to obtain username and password with a spoofed certificate and no alert is generated to the user. This vulnerability was found in Gizmo for Linux...

Link Logger syslogd resource overwhelm DoS

Remote: yes Credit: Mike Cyr, aka h00die Vulnerable: 2.4.10.15 ddwrt version but more than likely all versions Discussion: Link Logger is a program for logging, analysis and reporting of router traffic so you can easily spot attacks and abuses on your network. By sending a ton of spoofed traffic,...

firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

The Internationalized Domain Names IDN blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by...

DNS vulnerabilities to attack the Ruby code-vulnerability warning-the black bar safety net

1 require 'msf/core' 2 require 'net/dns' 3 require 'scruby' 4 require 'resolv' 5 6 module Msf 7 8 class Auxiliary::Spoof::Dns::BaliWickedHost Msf::Auxiliary 9 1 0 The include Exploit::Remote::Ip 1 1 1 2 def initializeinfo = 1 3 superupdateinfoinfo, 1 4 'Name' = 'DNS BaliWicked Attack', 1 5...

Gentoo Security Advisory GLSA 200903-14 (bind)

The remote host is missing updates announced in advisory GLSA 200903-14. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...