Researchers Reveal Fundamental SMS Flaws at Black Hat

There are several architectural and implementation problems in mobile phone networks that can be used to force users to open malicious files, allow attackers to gain control of users’ phones and change phone settings to redirect mobile Internet traffic to a proxy controlled by the attackers. In a...

New Flaw in Firefox Could Enable Phishing Attacks

There is a new vulnerability in Firefox that enables an attacker to open a new tab in a victim’s browser with a spoofed URL. The vulnerability is found in all current versions of Firefox and Mozilla does not have a patch for the problem yet. The vulnerability would be useful for attackers in a...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-2381

Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate...

CVE-2009-2381: Undefined Security Weakness

Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate...

Gizmo SSL Certificate Vulnerability

Gizmo SSL Certificate Vulnerability I. The Vulnerability Gizmo does not check SSL certificate before sending user credentials. An attacker is able to obtain username and password with a spoofed certificate and no alert is generated to the user. This vulnerability was found in Gizmo for Linux...

aMSN SSL Certificate Vulnerability

aMSN SSL Certificate Vulnerability I. The Vulnerability aMSN does not check SSL certificate before sending MSN user credentials. An attacker is able to obtain MSN username and password with a spoofed certificate and no alert is generated to the user. This vulnerability was found in aMSN 0.97.2...

Link Logger syslogd resource overwhelm DoS

Remote: yes Credit: Mike Cyr, aka h00die Vulnerable: 2.4.10.15 ddwrt version but more than likely all versions Discussion: Link Logger is a program for logging, analysis and reporting of router traffic so you can easily spot attacks and abuses on your network. By sending a ton of spoofed traffic,...

CVE-2009-1834: Improper Input Validation

Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through...

firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

The Internationalized Domain Names IDN blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by...

DNS vulnerabilities to attack the Ruby code-vulnerability warning-the black bar safety net

1 require 'msf/core' 2 require 'net/dns' 3 require 'scruby' 4 require 'resolv' 5 6 module Msf 7 8 class Auxiliary::Spoof::Dns::BaliWickedHost Msf::Auxiliary 9 1 0 The include Exploit::Remote::Ip 1 1 1 2 def initializeinfo = 1 3 superupdateinfoinfo, 1 4 'Name' = 'DNS BaliWicked Attack', 1 5...

Gentoo Security Advisory GLSA 200903-14 (bind)

The remote host is missing updates announced in advisory GLSA 200903-14. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Code injection

dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority SOA query...

CVE-2008-4392

dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority SOA query...

CVE-2008-4392

CVE-2008-4392 concerns the dns cache in the Berkeley dnscache (djbdns 1.05) where concurrent identical outbound DNS queries are not prevented. This can allow remote attackers to spoof DNS responses, demonstrated by a spoofed A record in an SOA response. Connected sources (Nessus/OpenVAS/Fedora ad...

Safari < 3.2.2 Multiple Vulnerabilities

Binary data 4932.prm...

CVE-2009-0418

The IPv6 Neighbor Discovery Protocol NDP implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service loss of connectivity, read private network traffic, and possibly execute...

CVE-2009-0418

CVE-2009-0418 concerns HP-UX IPv6 NDP where the Forward Information Base (FIB) can be spoofed due to unvalidated origins of Neighbor Discovery messages on HP-UX B.11.11, B.11.23, and B.11.31. The impact described includes denial of service, leakage of private network traffic, and potential arbitr...

CVE-2009-0418

The IPv6 Neighbor Discovery Protocol NDP implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service loss of connectivity, read private network traffic, and possibly execute...

Microsoft Internet Explorer Information Disclosure Vulnerability

Internet Explorer is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...