Mozilla Patches Firefox DLL Load Hijacking Bug

Mozilla has joined Apple in being among the first to fix the DLL load hijacking attack vector that continues to haunt hundreds of Windows applications. The open-source group released Firefox 3.6.9 with patches for a total of 15 vulnerabilities 11 rated critical, including the publicly known DLL...

Potential attack vector using attachments

Suspicious handling of attachment uploads with filenames containing quotes the quoted ended up being repeated and semicolons semicolon and all subsequent characters were stripped from filename...

Potential attack vector using attachments

Suspicious handling of attachment uploads with filenames containing quotes the quoted ended up being repeated and semicolons semicolon and all subsequent characters were stripped from filename...

Potential attack vector using attachments

Suspicious handling of attachment uploads with filenames containing quotes the quoted ended up being repeated and semicolons semicolon and all subsequent characters were stripped from filename...

Microsoft Security Advisory (2269637) Insecure Library Loading Could Allow Remote Code Execution

Microsoft Security Advisory 2269637 Insecure Library Loading Could Allow Remote Code Execution Published: August 23, 2010 Version: 1.0 General Information Executive Summary Microsoft is aware that research has been published detailing a remote attack vector for a class of vulnerabilities that...

Microsoft Visio 2010 14.0.4514.1004 DLL Hijacking Exploit

/ Microsoft Visio 2010 v14.0.4514.1004 dwmapi.dll DLL Hijacking Exploit Vendor: Microsoft Corp. Product Web Page: http://www.microsoft.com Affected Version: 14.0.4514.1004 MSO 14.0.4536.1000 Summary: Microsoft Visio is a diagramming program for Microsoft Windows that uses vector graphics to creat...

Microsoft Visio 2010 v14.0.4514.1004 (dwmapi.dll) DLL Hijacking Exploit

Summary Microsoft Visio is a diagramming program for Microsoft Windows that uses vector graphics to create diagrams. Description MS Visio 2010 suffers from a dll hijacking vulnerability that enables the attacker to execute arbitrary code on a local level. The vulnerable extension is .vss thru...

New Firefox iFrame Bug Bypasses URL Protections

UPDATED–There is a bug in Mozilla’s flagship Firefox browser related to the way the browser handles obfuscated URLs in iFrames. However, a Mozilla official said the bug poses “very low” risk to users. Johnathan Nightingale of Mozilla said in a blog post late Tuesday that the bug poses little risk...

Macs CMS 1.1.4 - SearchString Cross-Site Scripting

Macs CMS 1.1.4 - SearchString Cross-Site Scripting source: https://www.securityfocus.com/bid/41529/info Mac's CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Microsoft Windows Vector Markup Language Vulnerabilities (929969)

Remote exploitation of an integer overflow vulnerability in the Vector Markup Language VML support in multiple Microsoft products allows attackers to execute arbitrary code within the context of the user running the vulnerable application. OpenVAS Network Vulnerability Test Microsoft Windows Vect...

Microsoft Windows Vector Markup Language Vulnerabilities (929969)

Remote exploitation of an integer overflow vulnerability in the Vector Markup Language VML support in multiple Microsoft products allows attackers to execute arbitrary code within the context of the user running the vulnerable application. SPDX-FileCopyrightText: 2010 LSS Some text descriptions...

Orbis CMS 1.0.2 - editor-body.php Cross-Site Scripting

Orbis CMS 1.0.2 - editor-body.php Cross-Site Scripting source: https://www.securityfocus.com/bid/41390/info Orbis CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in...

Critical PDF Reader Patch Fixes '/Launch' Command Attack Vector

Adobe today shipped a critical Reader/Acrobat patch to cover a total of 17 documented vulnerabilities that expose Windows, Mac and UNIX users to malicious hacker attacks. The update, which affects Adobe Reader/Acrobat 9.3.2 and earlier versions, includes a fix for the outstanding PDF “/Launch”...

Spring Framework - Arbitrary code Execution

CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be affected Description: The Spring...

Mass SQL Injection Attack Hits Sites Running IIS

There’s a large-scale attack underway that is targeting Web servers running Microsoft’s IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there’s no clear indication of who’s behind the campaign righ...

JForum 2.1.8 - Username Cross-Site Scripting

JForum 2.1.8 - Username Cross-Site Scripting source: https://www.securityfocus.com/bid/40880/info JForum is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this issue...

Google Chrome multiple vulnerabilities - June 10

The host is running Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvulnjun10.nasl 5306 2017-02-16 09:00:16Z teissa $ Google Chrome multiple vulnerabilities - June 10 Authors: Madhuri D Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Gmail Checker Plus Chrome Extension Cross Site Scripting

Gmail Checker plus Chrome extension XSS extension: https://chrome.google.com/extensions/detail/mihcahmgecmbnbcchbopgniflfhgnkff advisore:http://lostmon.blogspot.com/2010/06/gmail-checker-plus-chrome-extension-xss.html Exploit available:yes So in this case "Google Mail Checker Plus" version 1.1.7...

CVE-2010-2133

SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-2942...

Java for Mac OS X 10.5 Update 7

The remote host is missing Java for Mac OS X 10.5 Update 7. SPDX-FileCopyrightText: 2010 LSS Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...