JVN#65427327 Sleipnir and Grani Bookmark Search vulnerable to arbitrary script execution

Sleipnir and Grani, web browsers from Fenrir & Co., have a bookmark search function. When a user runs the search function, the search result is displayed in the web browser. If a specially crafted URL is registered to the bookmark, an attacker could execute an arbitrary script on the user's web...

Mozilla-based browsers jar: URI cross-site scripting vulnerability

Overview Mozilla-based web browsers including Firefox contain a vulnerability that may allow an attacker to execute code, or conduct cross-site scripting attacks. Description The jar: protocol is designed to extract content from ZIP compressed files. Mozilla-based browsers include support for jar...

CVE-2002-2330

Cross-site scripting XSS vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via 1 HTTPUSERAGENT or 2 HTTPREFERER, which is written to stats.html and executed in client browsers...

Important: Red Hat Security Advisory: java-1.5.0-sun security update

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. The Java Runtime Environment JRE contains the...

CVE-2007-4465

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

Apple Quicktime (Multiple Browsers) Command Execution PoC (0day)

Exploit for multiple platform in category remote exploits ================================================================ Apple Quicktime Multiple Browsers Command Execution PoC 0day ================================================================ 0day.today 2018-01-06...

Apple QuickTime (Multiple Browsers) - Command Execution

milw0rm.com 2007-09-12...

Apple QuickTime (Multiple Browsers) - Command Execution

Apple QuickTime Multiple Browsers - Command Execution milw0rm.com 2007-09-12...

CVE-2007-4424

CVE-2007-4424 affects Apple Safari for Windows

Multiple Browsers - URI Handlers Command Injection

Multiple Browsers - URI Handlers Command Injection source: https://www.securityfocus.com/bid/25053/info Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers. Exploiting these issues allows remote attackers to pass and execute arbitrar...

iDefense Security Advisory 07.19.07: Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability

Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability iDefense Security Advisory 07.19.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 19, 2007 I. BACKGROUND Microsoft Internet Explorer and Mozilla Firefox are the two most popular web browsers. Many people have...

US-CERT Technical Cyber Security Alert TA07-192A -- Adobe Flash Player Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-192A Adobe Flash Player Updates for Multiple Vulnerabilities Original release date: July 11, 2007 Last revised: -- Source: US-CERT Systems Affected Microsoft Windows, Apple Mac OS X, Linu...

Sina blog XSS vulnerability-vulnerability warning-the black bar safety net

This afternoon just registered a Sina blog. And Baidu space, Sina only allows the editing part of the HTML Tag, the shield a lot of Tag and HTML attribute, the event is intended to prohibit the malicious code. Built a custom panel, find the content allowed in a STYLE tag, then write the following...

CVE-2007-2175

Apple QuickTime for Java (QTJava.dll) contains a heap memory corruption vulnerability in the toQTPointer function of QTHandleRef that can allow a remote, unauthenticated attacker to execute arbitrary code when Java is enabled in a browser (as demonstrated at CanSecWest 2007). The issue affects Qu...

CVE-2007-2175

Apple QuickTime Java extensions QTJava.dll, as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating...

Microsoft Agent URI Processing Remote Code Execution Vulnerability

Description The Microsoft Agent ActiveX control is prone to remote code execution. An attacker could exploit this issue to execute code in the context of the user visiting a malicious web page. Note that users who are running Windows Internet Explorer 7 are not affected by this vulnerability...

CVE-2007-1576

Multiple cross-site scripting XSS vulnerabilities in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the 1 Projects, 2 Contacts, 3 Helpdesk, 4 Search only Gecko engine driven Browsers, and 5 Notes...

XSS vulnerability in the online help system of several Cisco products

What: cross-site scripting XSS vulnerability in the online help system distributed with several Cisco products Release Date: 03-15-2007 Application: 14 different applications verified by Cisco up to now. For a complete list of affected products see...

: seamonkey cookie setting / same-domain bypass vulnerability

Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname location.hostname DOM property, due to...

n.runs-SA-2007.004 - PHProjekt 5.2.0 - Cross Site Scripting and Filter Evasion

n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.004 14-Mar-2007 Vendor: Mayflower GmbH, http://www.mayflower.de Affected Products: PHProjekt 5.2.0 Vulnerability: Cross Site Scripting and Filter Evasion Risk: HIGH Vendor communication: 2006/12/31 initial notification of...