Cross site scripting

Google Chrome 11 does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader...

Cross site scripting

Mozilla Gecko before 5.0, as used in Firefox before 5.0 and Thunderbird before 5.0, does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader...

CVE-2011-2366

Mozilla Gecko before 5.0, as used in Firefox before 5.0 and Thunderbird before 5.0, does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader...

CVE-2011-2599

Google Chrome 11 does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader...

CVE-2011-2599

Google Chrome 11 does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader...

CVE-2011-2599

Removed by vendor...

PT-2011-3948

Name of the Vulnerable Software and Affected Versions Google Chrome version 11 Description The issue allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader, as Google Chrome 11 does not block the use of a cross-domain...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple memory corruptions, buffer overflows, integer overflows, cross domain data access...

PT-2011-3805

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 5.0 Mozilla Thunderbird versions prior to 5.0 Description The issue allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader, by no...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2011-19 Miscellaneous memory safety hazards rv:3.0/1.9.2.18 MFSA 2011-20 Use-after-free vulnerability when viewing XUL document with script disabled MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace images MFSA 2011-22 Integer overflow and arbitrary...

Stealing of cross-domain images using WebGL textures — Mozilla

Security research firm Context IS discovered that an image from a different domain could be loaded into a WebGL texture, and then each pixel could be rendered into a canvas element with a shader program, creating an approximation of the image in a form that was readable by the creator of the WebG...

Microsoft Internet Explorer Drag and Drop Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability. An attacker can exploit this issue to access content from another domain or security zone. This may allow the attacker to obtain sensitive information that may aid in further attacks...

CVE-2011-2153

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2011-2152

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

Cross site scripting

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2011-2152

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

CVE-2011-2152

The CVE-2011-2152 entry concerns SmarterTools SmarterStats 6.0 web server behavior: responses to GET requests with certain query strings (Client/frmViewReports.aspx or UserControls/Popups/frmHelp.aspx) generate pages containing external links, enabling cross-domain Referer leakage. This can allow...

CVE-2011-2153

CVE-2011-2153 affects SmarterTools SmarterStats 6.0 Web server. The vulnerability arises from Login.aspx accepting txtUser/txtPass in the query string, enabling context-dependent attackers to discover credentials by reading server access logs, Referer logs, or browser history (cross-domain Refere...

CVE-2011-2153

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

PT-2011-3640

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain sensitive information by exploiting a "cross-domain Referer leakage" issue. This is achieved through GET requests with query strings for specific API...