Re: Suspicious URL:Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

On 10/02/15 19:06, Christoph Gruber wrote: > in http://support.microsoft.com/kb/833786/en-us Sorry, that link is suspicious. -- -- Joshua Rogers signature.asc Description: OpenPGP digital signature

Re: Suspicious URL:Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

I love "Suspicious URL". It reminds me the microsoft KB article speaking of "Malicious Hyperlink" "The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them." in http://support.microsoft.com/kb/833786/en-us -- Christoph Gruber Am 09.02.2

Suspicious URL:Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

Not sure what you think about this one.It appears to be a bug with IE. --- // Shawn On Feb 5, 2015, at 12:06 AM, David Leo wrote: > "is this entirely an IE flaw" > Yes. > > "is it tied to the use of Cloudflare" > No. > > "I tried to reproduce... was unsuccessful" > Likely, this detail

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

o: David Leo; Joey Fowler Cc: fulldisclos...@seclists.org; b...@securitytracker.com; bugtraq@securityfocus.com; cve-ass...@mitre.org Subject: Re: [FD] Major Internet Explorer Vulnerability - NOT Patched Hi David, Nice one…great find! And thanks Joey for confirming the bypass of HTTP-to-HTTPS restrictions

RE: [FD] Major Internet Explorer Vulnerability - NOT Patched

g Subject: Re: [FD] Major Internet Explorer Vulnerability - NOT Patched So here's a possibly stupid question: is this entirely an IE flaw, or is it tied to the use of Cloudflare by the targeted site as well as the attacking site? I ask because: 1 - I tried to reproduce the attack in a number of ways

Very Important Info About "Major Internet Explorer Vulnerability - NOT Patched"

1. "Spartan - vulnerable (Windows 10)" http://www.deusen.co.uk/items/insider3show.3362009741042107/SpartanWin10_screenshot.png Thanks to Zaakiy Siddiqui! 2. http://www.dailymail.co.uk/robots.txt";); ?> Many asked for it. 3. It's Universal XSS, as we tested: Not only dailymail.co.uk - also Yahoo

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

"is this entirely an IE flaw" Yes. "is it tied to the use of Cloudflare" No. "I tried to reproduce... was unsuccessful" Likely, this detail is missing: http://www.dailymail.co.uk/robots.txt";); ?> Please tell us whether you reproduce(with the PHP code). "am I correct... JavaScript hosted on sha

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

Microsoft was notified on Oct 13, 2014. Joey thank you very much for your words. Kind Regards, On 2015/2/3 4:53, Joey Fowler wrote: Hi David, "nice" is an understatement here. I've done some testing with this one and, while there /are/ quirks, it most definitely works. It even bypasses stan

Major Internet Explorer Vulnerability - NOT Patched

Deusen just published code and description here: http://www.deusen.co.uk/items/insider3show.3362009741042107/ which demonstrates the serious security issue. Summary An Internet Explorer vulnerability is shown here: Content of dailymail.co.uk can be changed by external domain. How To Use 1. Close