Mozilla Firefox Security Advisories (MFSA2017-21, MFSA2017-22) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox Security Advisories (MFSA2017-21, MFSA2017-22) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

GNU C Library DNS Spoofing Vulnerability

The GNU C Library a.k.a. glibc, libc6 is an open-source, free C language compiler released under the LGPL license. A security vulnerability exists in the DNS stub resolver in the GNU C Library. An attacker can exploit this vulnerability to perform a DNS spoofing attack...

Mozilla Firefox ESR Security Advisories (MFSA2017-18, MFSA2017-19) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Google Chrome Omnibox URL Forgery Vulnerability

Google Chrome is a web browser developed by Google Inc. in the United States. A URL forgery vulnerability exists in Google Chrome Omnibox, which allows remote attackers to exploit this vulnerability by submitting a special WEB page and tricking the user into parsing it, which can be used to spoof...

UBUNTU-CVE-2017-5415

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox 52...

UBUNTU-CVE-2017-5417

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. This vulnerability affects...

Jappix XMPP Client User Impersonation Vulnerability

XMPP video timely communication system, support single chat group chat.Jappix is a full-featured XMPP WEb client. A user impersonation vulnerability exists in the Jappix XMPP Client. An attacker can exploit this vulnerability to spoof any user and launch further attacks...

Google Chrome Security Updates (stable-channel-update-for-desktop-2017-01) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Bzrtp Man-in-the-middle Spoofing Vulnerability

bzrtp is an open source ZRTP key exchange protocol. Bzrtp suffers from a man-in-the-middle spoofing vulnerability. An attacker can exploit the vulnerability to conduct spoofing attacks and perform unauthorized manipulation...

CVE-2016-0241

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof administrator accounts by sending a modified login request over HTTP...

Animas OneTouch Ping Authentication Bypass Vulnerability (CNVD-2016-08537)

The Animas OneTouch Ping is a medical self-service device for diabetics taking insulin from Animas USA. The Animas OneTouch Ping device uses a customized communication protocol that allows an unauthenticated remote attacker to bypass authentication by relaying the attack and spoofing the affected...

TLS protocol man-in-the-middle attack vulnerability (CNVD-2016-08101)

The TLS Transport Layer Security protocol is a set of protocols used to provide confidentiality and data integrity between two communicating applications. A security vulnerability exists in the TLS protocol that allows a remote attacker to spoof a TLS server via a man-in-the-middle attack with th...

The vulnerability of the Firefox browser, which allows attackers to carry out spoofing attacks

The vulnerability of Firefox browsers is related to the incorrect installation of the "LINKABLE" and "URISAFEFORUNTRUSTEDCONTENT" flags, which are used for error pages. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks using specially crafted URLs...

openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-960)

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included : - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...

Mozilla Firefox Forgery Attack Vulnerability

Mozilla Firefox is an open source web browser; Mozilla Firefox fails to properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags for about: URLs used by error pages, allowing remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by users...

CVE-2016-5268

Mozilla Firefox before 48.0 does not properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d=...

Security update for MozillaFirefox, mozilla-nss (important)

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included: - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...

firefox: multiple issues

CVE-2016-0718 arbitrary code execution Out-of-bounds read during XML parsing in Expat library. - CVE-2016-2830 information disclosure Favicon network connection can persist when page is closed. - CVE-2016-2835 CVE-2016-2836 arbitrary code execution Mozilla developers and community members...

Spoofing attack due to unvalidated KDC

Overview Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed...