MSIE7 entrapment again (+ FF tidbit)

Hello again, Microsoft Internet Explorer seems to have a soft spot for browser entrapment vulnerabilities. Just to recap, in these attacks, the user is made believe he had left a webpage and the URL bar or SSL state data reinforce him in this belief - but in reality, is prevented from doing so, a...

DRUPAL-SA-2006-002 XSS vulnerabilities

Some user input sanity checking was missing. This could lead to possible cross-site scripting XSS attacks. XSS can lead to user tracking and theft of accounts and services. Versions affected All Drupal versions before 4.6.6. Solution If you are running Drupal 4.5.x then upgrade to Drupal 4.5.8. I...

[DRUPAL-SA-2005-007] Drupal 4.6.4 / 4.5.6 fixes XSS issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2005-007 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2005-007 Project: Drupal core Date: 2005-11-30 Security risk: less critical...

Gator/GAIN Spyware Installed

The remote host has Gator/GAIN Spyware Installed. Gator tracks the sites that users visit and forwards that data back to the company's servers. Gator sells the use of this information to advertisers. It also lets companies launch a pop-up ad when users visit various Web sites. This software is no...

PhpMyFAQ 1.5.1 multiple vulnerabilities

2.31 23/09/2005 PhpMyFaq 1.5.1 SQL injection / board takeover / user info disclosure / path disclosure remote code / commands execution software: site: http://www.phpmyfaq.de/ description: "phpMyFAQ is a multilingual, completely database-driven FAQ-system. It supports various databases to store a...

Autocomplete data leak — Mozilla

As users downarrow through autocomplete choices each is copied in turn into the input control. A malicious site could create a page that autocompletes some common data such as phone number or SSN and potentially convince a user to arrow through the values. Script on the page could watch the value...

Moderate: Red Hat Security Advisory: thunderbird security update

An updated Thunderbird package that fixes a security issue is now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Thunderbird is a standalone mail and newsgroup client. A bug was found in the way...

CVE-2003-0208

Cross-site scripting XSS vulnerability in Macromedia Flash ad user tracking capability allows remote attackers to insert arbitrary Javascript via the clickTAG field...

CVE-2003-0208

CVE-2003-0208 describes an XSS vulnerability in Macromedia Flash ad user tracking, exploitable via the clickTAG field to inject arbitrary JavaScript. Affected component: Flash ad-tracking capability; root cause: input in clickTAG not properly sanitized. Impact (per provided metrics): partial inte...

Opera 7.0 - History Object Information Disclosure

source: https://www.securityfocus.com/bid/6757/info An information disclosure weakness has been reported for Opera 7 browsers on the Microsoft Windows platform. The weakness is due to the way the history object exposes some properties. Specifically, the properties history.next and history.previou...

Opera 7.0 - History Object Information Disclosure

Opera 7.0 - History Object Information Disclosure source: https://www.securityfocus.com/bid/6757/info An information disclosure weakness has been reported for Opera 7 browsers on the Microsoft Windows platform. The weakness is due to the way the history object exposes some properties. Specificall...

webtv-insecurities.txt

Date: Mon, 12 Oct 1998 21:32:49 -0600 MDT From: mea culpa To: InfoSec News Subject: ISN Web TV owns your cache Forwarded From: Jon http://www.usatoday.com/life/cyber/zd/zd7.htm 10/12/98- WebTV is watching you From: Inter@ctive Week Online Microsoft Corp.'s WebTV Networks Inc. is quietly using a...