7464 matches found
Apple Safari for Windows远程拒绝服务漏洞
Apple Safari是苹果家族操作系统所使用的WEB浏览器。 Apple Safari在处理畸形网页时存在漏洞，远程攻击者可能利用此漏洞导致浏览器崩溃。 如果用户在Windows平台上使用Safari浏览器访问了恶意站点的话，就可能导致越界内存读取，应用程序可能会意外终止。 Apple Safari for Windows 3 Beta 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com/safari/download/...
JVN#16535199: Apache Tomcat Accept-Language Header Cross-Site Scripting Vulnerability
Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat contains a cross-site scripting vulnerability. It occurs when the value of the Accept-Language header sent from a client is non-standard. The developer ha...
JVN#27203006 Internet Explorer vulnerable in MHTML handling
When Internet Explorer accesses a website with the MHTML protocol, Internet Explorer processes the contents as MHTML data, ignoring their actual content types. This behavior may result in executing the scripts embedded in the contents. The MHTML protocol handler is included in the Outlook Express...
Opera Web浏览器运行Adobe Flash播放器未明漏洞
Opera是一款开放源代码的WEB浏览器。 运行在Linux, Solaris或FreeBSD操作系统上的Opera处理Adobe Flash播放器存在未明安全问题，远程攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 S.u.S.E. openSUSE 10.2 S.u.S.E. Novell Linux Desktop 9 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 9.3 x8664 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux...
[SECURITY] [DSA 1308-1] New iceweasel packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 1308-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 14th, 2007 http://www.debian.org/security/faq -...
[Full-disclosure] Apple Safari: cookie stealing
There is a vulnerability in Apple Safari, that allows an attacker to steal a cookie belonging to the arbitrary domain or/and fill the browser window with an arbitrary content, whereas the url bar and the browser's window title is derived from the selected domain. The flaw exists in the javascript...
MS07-031: Vulnerability in the Windows Schannel Security Package Could Allow Remote Code Execution (935840)
The remote host is running a version of Windows that has a bug in the SSL/TLS server-key exchange handling routine that may allow an attacker to execute arbitrary code on the remote host by luring a user on the remote host into visiting a rogue website. On Windows 2000 and 2003 this vulnerability...
Microsoft Outlook Express MHTML URL Parsing Information Disclosure Vulnerability
Description Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim user's browser. Attackers could exploit this issue to gain access to...
Microsoft Internet Explorer Prototype Variable Uninitialized Memory Corruption Vulnerability
Description Microsoft Internet Explorer is prone to a memory-corruption vulnerability when accessing objects that are improperly instantiated or deleted. An attacker may exploit this issue by enticing victims into opening a maliciously crafted webpage. Successfully exploiting this issue allows...
Microsoft Internet Explorer Speech API 4 COM Object Instantiation Buffer Overflow Vulnerabilities
Description Microsoft Internet Explorer is prone to multiple buffer-overflow vulnerabilities when instantiating certain COM objects. An attacker may exploit these issues by enticing victims into opening a maliciously crafted webpage. Successfully exploiting these issues allows remote attackers to...
Microsoft Windows CE .NET Compact Framework Components Multiple Vulnerabilities
Description Components of the .NET Compact Framework for Microsoft Windows CE are prone to multiple vulnerabilities. Exploiting these issues may allow remote attackers to cause denial-of-service conditions, corrupt memory, or execute arbitrary machine code in the context of the affected...
Microsoft Outlook Express Content Disposition Parsing Information Disclosure Vulnerability
Description Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim's browser. Attackers could exploit this issue to access sensitive...
SOL7521 - Stack-based buffer overflow vulnerability in web browser plug-in
In order for this exploit to be successful, the attacker must persuade you to view the malicious web page. If you view the malicious web page in a browser that has affected FirePass plug-in installed, this could result in malicious code execution on the client side, disclosure of sensitive...
F5 FirePass 4100 SSL VPN My.Activiation.PHP3远程命令注入漏洞
F5's FirePass SSL VPN提供使用标准WEB浏览器对应用程序和数据进行安全访问的解决方案。 F5 FirePass 4100不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'my.activation.php3'脚本对用户提交的'username'参数缺少过滤，在部分条件下允许用户注入Linux SHELL命令，导致以WEB权限执行。 F5 FirePass 4100 厂商解决方案 可参考如下安全公告获得补丁信息： https://tech.f5.com/home/solutions/sol167.html...
[SECURITY] Fedora 7 Update: galeon-2.0.3-9.fc7
Galeon is a web browser built around Gecko Mozilla's rendering engine and Necko Mozilla's networking engine. It's a GNOME web browser, designed to take advantage of as many GNOME technologies as makes sense. Galeon was written to do just one thing - browse the web...
devhelp, firefox, yelp security update
CentOS Errata and Security Advisory CESA-2007:0400 Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source...
[SECURITY] Fedora 7 Update: firefox-2.0.0.4-1.fc7
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
[SECURITY] Fedora 7 Update: epiphany-2.18.1-3.fc7
epiphany is a simple GNOME web browser based on the Mozilla rendering engine...