Whitepaper called Dissecting Java Server Faces for Penetration Testing. This paper is divided into two parts. In the first part, they discuss the internals of JSF, a Java based web application framework and its inherent security model. In the second part, they discuss about the security weaknesses and applied security features in the JSF. In addition, they also raise a flag on the security issues present in JSF in order to conduct effective penetration testing.
3e0ca590152a28d58e6b4fd24b67f72aWhitepaper called Digging Inside VxWorks OS and Firmware - Holistic Security. VxWorks is one of the most widely accepted embedded OSes. In this paper, they have conducted a detailed study of the VxWorks OS security model and firmware in order to understand the potential impact of security vulnerabilities and weaknesses.
2fe7af017754aecc2f68198a7bb61a86A persistent cross site scripting vulnerability exists in the Oracle I-Recruitment portal. The account information page allows the user to upload his resume in Microsoft Word document. An attacker can construct a malicious MSWord file to conduct the attack by setting a cross site scripting payload in hyperlinks in order to bypass conversion filters. Versions 11.5.10.2, 12.0.6, and 12.1.3 are affected.
915143d62fe7b7aa1ae2e6f7397f485bNoScript versions prior to 2.0.5.1 suffer from a reflective cross site scripting vulnerability via SQL injection.
a72867c60f313ec24d57275614fa6630An open redirect vulnerability exists in Oracle I-Recruitment versions 11.5.10.2, 12.0.6 and 12.1.3.
3333af513cf55c5154575bb75e5fbebaA null pointer dereference vulnerability has been noticed in Microsoft Word. The exception results in the MSO.dll library failing to handle the specially crafted buffer in a file. The issue can be potentially triggered by opening a malicious word file which results in a null pointer exception due to invalid memory read.
f3b806eba3e1abc910f546d7ddf25357Whitepaper called Reverse Honey Trap - Striking Deep Inside Online Web Antivirus Engines and Analyzers.
979913c772244ef601f8a0becdd79981This document discusses cookie hijacking in Google Docs through PDF repurposing attacks. This has since been fixed by Google.
6f3ea64aae2840c0c5478f706fc00349Whitepaper called PDF Silent HTTP Form Repurposing Attacks.This paper sheds light on the modified approach to trigger web attacks through JavaScript protocol handler in the context of browser when a PDF is opened in it.
c479c678c56f00b1d37c49038f79e6c6Google Chrome version 1.0.154.53 "throw exception" remote crash and denial of service exploit.
006378449d255dc12db2c80fbe873d6fMozilla Firefox version 3.0.8 zero buffer check memory exhaustion and leaking proof of concept exploit.
3f2baa2f8b24cf6cb339b7d828a85135Whitepaper called Evading Web XSS Filters through Word (Microsoft Office and Open Office in Enterprise Web Applications.
f76e72f4a3743def423d7e1772986353Google Chrome version 1.0.154.48 single thread alert out of bounds memory access exploit.
1f93f75509617183ceefe6ca07822f2dThe Google Chrome browser versions 1.0.154.43 and below suffer from a clickjacking vulnerability.
a9a882cf4eefe4cae82f829e96fa34eaOracle E-Business Suite Release 12, version 12.0.6 and Oracle E-Business Suite Release 11i, version 11.5.10.2 both suffer from a sensitive information disclosure vulnerability.
562ba71c97713005872e8f8546edad39Google Chrome versions 0.2.149.30, 0.2.149.29, and 0.2.149.27 all suffer from a metacharacter URI obfuscation vulnerability. Proof of concept html included.
f26473051cd14f19ff80806f58c603ddOpera version 9.52 suffers from a window object suppression denial of service vulnerability.
6278660487e20b372b753680b4f5256cThe user interface in Mozilla Firefox version 3.0.3 suffers from a null pointer dereference crash.
9f5af9f0f888657db9feb53e0d6aa5c3Google Chrome version 0.2.149.30 suffers from a window object suppression denial of service vulnerability.
e4bba44b67a347594dfd38b5bb879a05Google Chrome versions 0.2.149.30 and 0.2.149.29 carriage return NULL object memory exhaustion denial of service proof of concept exploit.
4b420b098cbf197783426bca8b1464d9Microsoft Internet Explorer 7 is susceptible to a denial of service vulnerability when handling malicious PNG files.
fe53be703eba1e969a3564fbcf3ecf2aWhitepaper titled Binary JSON: Insecurity In Implementing Serialization.
e87fa0203d5d04e163bdf94de4a6f5bcJWIG might allow context-dependent attackers to cause a denial of service via loops of references to external templates.
cc22107a34b0f9a61e6d37de45ea58feVerisign has various open HTTP redirect servers that may assist phishing.
cd49eb736abc0756d54da4034f1314b8Whitepaper entitled Ambiguity In Ajax Lockdown Framework - Unveiling Some Contradictory Facts.
c72d1fdf0586fb064c35e73407382130
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed