Firefox, IE7 open to URL spoof
124001
Firefox and Internet Explorer 7 do not properly handle JavaScript "onUnload" events and can be tricked into taking a user to the wrong URL, according to security researcher Michal Zalewski.
729334
(InfoWorld) - A vulnerability in Microsoft Internet Explorer (IE) browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday. The flaw lies in the way IE7 processes a locally stored HTML (Hypertext Markup Language) error message page that is typically shown when the user cancels the loading of a Web page, said Aviv Raff, a security researcher based in Israel. The error message tells the user that "navigation to the webpage was cancelled," and offers the user the opportunity to "refresh the page." If the refresh link is clicked, IE can be tricked into displaying the wrong Web address for a page. Raff has published proof of concept code that shows how IE can be made to display a Web page on his Web site as if it is from the cnn.com domain. This flaw could be exploited by phishers who want to make their spoofed Web sites appear legitimate, Raff said. "I can inject a script that will display anything I want in the page when the user clicks the 'refresh' link," he said via instant message. "Combining this with the design flaw, an attacker can render in the browser whatever he wants with whatever URL he wants in the address bar." This type of bug is known as a cross-site scripting vulnerability. It affects IE 7 on Vista and Windows XP, Raff added. Microsoft could not immediately confirm Raff's findings, but the company issued a statement saying that it is investigating the issue and is "not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time."
406027
Microsoft ISA and Proxy Server are prone to an Internet domain name spoofing vulnerability that could allow an attacker to spoof Internet sites.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.
643971
Every 30th or so request for an advert was redirected to another compromised server, which in turn tried to execute the Bofra Internet Explorer exploit in an attempt to infect the user&#39;s machine.
363180
Floor by flaw The latest versions of Internet Explorer and Firefox on Windows and (in the case of Firefox) Unix systems are vulnerable to attacks that could reveal the contents of sensitive files residing on a victim's hard drives.â¦
86222
In brief Exploit circulating for unpatched vuln
175699
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) web browser allows attackers to create a fake website that looks exactly like a genuine site.
196884
A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
535328
Mozilla is starting to pose a threat to Microsoftâs Internet Explorer after years of being the darling of a strange mix of AOL enthusiasts and techies.
14206
InfoWorld - A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
143342
A vulnerability in Internet Explorer spells potential trouble for Skype users who add or play video in their chats.
178847
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2.0 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
221084
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) Web browser allows attackers to create a fake Web site that looks exactly like a genuine site.
614724
The Firefox browser is vulnerable to a flaw related to its pop-up blocker technology that could give access to local files, security analysts said.
745224
Security experts uncovered yet another bug in Internet Explorer this week, one that could let attackers replace the content of any legit site with their own, making it possible to spoof critical pages such as e-bank account access log-in forms or credit
437595
Hackers can drop malicious code into systems running Firefox when the browser is armed with Google Toolbar, Yahoo Toolbar, or other add-ons.