CVE-2013-4955

Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter...

CVE-2013-4955

Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter...

Open redirect

Open redirect vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...

Information disclosure

Google Glass before XE6 does not properly restrict the processing of QR codes, which allows physically proximate attackers to modify the configuration or redirect users to arbitrary web sites via a crafted symbol, as demonstrated by selecting a Wi-Fi access point in order to conduct a...

CVE-2013-1698

The getUserMedia permission implementation in Mozilla Firefox before 22.0 references the URL of a top-level document instead of the URL of a specific page, which makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web site that uses IFRAME...

Open redirect

Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management ZCM 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage...

Study Shows Google Better than Bing at Filtering Malicious Web Sites

A German security company spent 18 months analyzing malware among millions of Web sites ranked by the world’s most popular search engines and concluded Google was safer than Bing. More than half of the 40 million Web sites analyzed by the AV-Test Institute in Magdeburg, Germany were provided...

Design/Logic Flaw

Google Chrome before 26.0.1410.43 does not properly restrict brute-force access attempts against web sites that require HTTP Basic Authentication, which has unspecified impact and attack vectors...

CVE-2013-0922

Google Chrome before 26.0.1410.43 does not properly restrict brute-force access attempts against web sites that require HTTP Basic Authentication, which has unspecified impact and attack vectors...

Open redirect

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified...

CVE-2012-6101

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to 1 backup/backupfilesedit.php, 2 comment/commentpost.php, 3...

CVE-2012-6467

Opera before 12.10 follows Internet shortcuts that are referenced by a 1 IMG element or 2 other inline element, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site, as exploited in the wild in November 2012...

Libsyn Cross Site Scripting Vulnerability

Libsync suffers from a cross site scripting vulnerability. As you can see from my publications for last five years, I like holes which are placed at hundreds or millions of web sites. Since my 2008's article XSS vulnerabilities in 215000 flash files...

Libsyn Cross Site Scripting

Hello list! As you can see from my publications for last five years, I like holes which are placed at hundreds or millions of web sites. Since my 2008's article XSS vulnerabilities in 215000 flash files http://lists.webappsec.org/pipermail/websecuritylists.webappsec.org/2008-November/004655.html...

Open redirect

Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Hunting Badware

Security often is discussed in super-serious terms, using metaphors and analogies from the military or medical communities to underscore the gravity of the situation. But the truth is, some of this stuff is pretty funny, and the folks at StopBadware.org know this. To explain the way that attacker...

XXE Injection in CakePHP and Squiz CMS

Hello! I'll give you additional information concerning advisories CakePHP 2.x-2.2.0-RC2 XXE Injection http://securityvulns.ru/docs28331.html and Squiz CMS Multiple Vulnerabilities http://securityvulns.ru/docs28220.html. It's about XXE Injection in CakePHP and Squiz CMS. Similarly to earlier...

CVE-2012-3611

WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1...

New E-Banking Trojans Target Android Users

The security firm Trusteer reports that new Web-based attacks are targeting Android smartphone users in a campaign to circumvent two-factor sign-on features used by many banks to protect account holders. Writing on the Trusteer blog on Tuesday, CTO Amit Klein of Trusteer said that researchers the...

Vulnerabilities in JW Player and millions of web sites

Hello 3APA3A! I want to warn you about security vulnerabilities in JW Player. These are Content Spoofing and Cross-Site Scripting vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are JW Player 5.9.2156 and 5.9.2206, except one vulnerability and...