Input stealing from other tabs — Mozilla

Jakob Balle of Secunia reported two vulnerabilities in windows with multiple tabs. Malicious content in a background tab can attempt to steal information intended for the topmost tab by popping up prompt dialog that appears to come from the trusted site, or by silently redirecting input focus to ...

[Full-Disclosure] Xanga Login Cookie stealing Vunerability - GNAA Security Center

Vendor: Xanga URL: http://www.xanga.com/ Versions: Current Remote: Yes vendor notified: 06 Oct 2004 at 14:08 Vendor response: NONE Summary: Xanga is a fully featured blogging system, it provides great control over look & feel of a users blog by allowing HTML with only basic checks. Xanga has well...

Debian DSA-167-1 : kdelibs - XSS

A cross site scripting problem has been discovered in Konqueror, a famous browser for KDE and other programs using KHTML. The KDE team reportsthat Konqueror's cross site scripting protection fails to initialize the domains on sub-iframes correctly. As a result, JavaScript is able to access any...

CVE-2002-1152

CVE-2002-1152 concerns Konqueror (KDE) versions 3.0 through 3.0.2. The issue is that Konqueror does not reliably detect the secure flag on HTTP cookies, allowing cookies to be sent over unencrypted channels. This could enable remote attackers to capture cookies via sniffing, potentially compromis...

CVE-2002-1367: Undefined Security Weakness

Common Unix Printing System CUPS 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need...

PScript PForum 1.24/1.25 - User Profile HTML Injection

source: https://www.securityfocus.com/bid/10954/info PScript PForum is reported prone to a HTML injection vulnerability. The vulnerability presents itself due to a lack of sufficient sanitization performed on data submitted through input fields of the PForum user profile form. This could be...

waraxe-2004-SA027.txt

================================================================================ waraxe-2004-SA027 ================================================================================ Once again - critical vulnerabilities in PhpNuke 6.x - 7.2...

[Full-Disclosure] [waraxe-2004-SA#027 - Once again - critical vulnerabilities in PhpNuke 6.x - 7.2]

================================================================================ waraxe-2004-SA027 ================================================================================ Once again - critical vulnerabilities in PhpNuke 6.x - 7.2...

[waraxe-2004-SA#001] - Script injection in GBook for Php-Nuke ver. 1.0

================================================================================ waraxe-2004-SA001 ================================================================================ Script injection in GBook for Php-Nuke ver. 1.0...

Multiple vulnerabilites in vendor IKE implementations, including Cisco,

Nortel, and Microsoft Reply-To: [email protected] INTRODUCTION This message will describe two serious vulnerabilities in the default configurations of IKE implementations. They are particularly common in so called "VPN client" implementations. Both allow easy session stealing and man-in-the-middle...

Microsoft ISA Server HTTP error handler XSS (TL#007)

Thor Larholm security advisory TL006 ------------------------------------- 16 July 2003 HTML format: http://pivx.com/larholm/adv/TL006 Topic: ISA Server HTTP error handler XSS. Discovery date: 25 June 2002. Severity: Medium Affected applications: ---------------------- Any Microsoft Internet...

Perception LiteServe 2.0.1 - Directory Query String Cross-Site Scripting

Perception LiteServe 2.0.1 - Directory Query String Cross-Site Scripting source: https://www.securityfocus.com/bid/6143/info A cross site scripting vulnerability has been discovered in Perception LiteServe. It has been reported that LiteServe fails to sanitize query strings from indexed folders. ...

DSA-167 kdelibs - cross site scripting

Bulletin has no description...

KDE Security Advisory: Konqueror Cross Site Scripting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: Konqueror Cross Site Scripting Vulnerability Original Release Date: 2002-09-08 URL: http://www.kde.org/info/security/advisory-20020908-2.txt 0. References http://online.securityfocus.com/archive/1/290710/2002-09-03/2002-09-09/0 ...

IE allows universal Cross Domain Scripting (TL#003)

Thor Larholm, PivX, security advisory TL003 ------------------------------------- By Thor Larholm, Denmark 10 July 2002 HTML format: http://www.PivX.com/larholm/adv/TL003/ Topic: IE allows universal Cross Domain Scripting. Discovery date: 25 June 2002. Severity: High Affected applications:...

the other IE cookie stealing bug (MS01-055)

The patch for MS01-055 released today by Microsoft includes three fixes. Two of them are for cookie stealing bugs. One of those cookie stealing bugs was previously publicized on bugtraq, details on the other are now available at http://alive.znep.com/marcs/security/iecookie2/ This document is...

CGIWrap 2.x3.x - Cross-Site Scripting

CGIWrap 2.x3.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/3081/info CGIWrap is a free, open-source program for running CGI securely. CGIWrap does not filter embedded scripting commands from user-supplied input. A web user may submit a malicious link into any form which...

Microsoft Internet Explorer 45 - DHTML Edit ActiveX Control File Stealing Cross Frame Access

Microsoft Internet Explorer 45 - DHTML Edit ActiveX Control File Stealing Cross Frame Access source: https://www.securityfocus.com/bid/116/info Vulnerabilities in an ActiveX control distributed with Internet Explorer 5 and available for Internet Explorer 4 allow malicous web sites to steal local...

Microsoft Internet Explorer 4/5 - DHTML Edit ActiveX Control File Stealing / Cross Frame Access

source: https://www.securityfocus.com/bid/116/info Vulnerabilities in an ActiveX control distributed with Internet Explorer 5 and available for Internet Explorer 4 allow malicous web sites to steal local files and to bypass cross-frame security rules. The DHTML Edit Control Safe for Scripting...