InternetSpySoftware.com

The Register: MS Security Patch Fails on Local Files
The MS patch intended to fix a data binding flaw in IE, which enables a script to call executables on your Windows machine using the object tag, does not protect against malicious files launched from a local directory.
www.theregister.co.uk/

GreyMagic Security: Appendix to "IE allows universal Cross Site Scripting"
Explains how the "ANALYZE.DLG" resource can be manipulated to allow the execution of arbitrary code in the My Computer" zone.
sec.greymagic.com/

Microsoft: Q167614 - Update Available For "Frame Spoof" Security Issue
An update that addresses a potential security issue with regard to the use of frames in Internet Explorer.
support.microsoft.com/

The Register: Three New MS Security Holes - Two Nasty
Includes: MSXML may ignore IE security zone settings during a request for data from a Web site; and a VBscript problem which allows an attacker to read files on a victim's local drive, or eavesdrop on his browsing session.
www.theregister.co.uk/

Urlscan Security Tool
Urlscan is a powerful security tool that works in conjunction with the IIS Lockdown Tool to give IIS Web site administrators the ability to turn off unneeded features and restrict the kind of HTTP requests that the server will process.
www.microsoft.com/

Scott Schnoll's Internet Explorer Security
Information on Internet and web browser security as well as Microsoft Internet Explorer security features and flaws.
www.nwnetworks.com/

Windows Security Guide: Internet Explorer
Descriptions, and patch information, for vulnerabilities affecting various versions of this browser.
www.winguides.com/

Vicomsoft Firewall and Internet Security Software
FAQs, White Papers, case studies and trial downloads of firewall and filtering software.
www.vicomsoft.com/

AppDetective
Penetration testing scanner that locates and assesses the strength of databases and web applications within your network.
www.appsecinc.com/

NGSSoftware
Security scanners and assessment tools for Oracle, Domino, and SQL Server. Checks for weak passwords and vulnerability to SQL injection and cross-site scripting.
www.nextgenss.com/