2422 matches found
linux-flashplugin -- multiple vulnerabilities
Adobe Product Security Incident Response Team reports: A critical vulnerability has been identified in Adobe Flash Player version 10.0.42.34 and earlier. This vulnerability CVE-2010-0186 could subvert the domain sandbox and make unauthorized cross-domain requests. This update also resolves a...
Google Chrome < 4.0.249.78 Multiple Vulnerabilities
Binary data 5328.pasl...
Google Chrome < 4.0.249.78 Multiple Vulnerabilities
The version of Google Chrome installed on the remote host is earlier than 4.0.249.78. Such versions are reportedly affected by multiple vulnerabilities : - A pop-up blocker bypass. Issue 3275 - Cross-domain theft due to CSS design error. Issue 9877 - Browser memory error with stale pop-up block...
Microsoft Internet Explorer Cross Domain Information Disclosure (MS06-042; CVE-2006-3280)
Microsoft Internet Explorer IE is the most widely used web browser application. The browser is capable of processing HTML, images, scripting languages, and various other popular Internet specifications. Internet Explorer has numerous built-in mechanisms that enforce security policies which are...
Adobe Acrobat Script Injection
================================================================================ Stratsec Security Advisory: SS-2010-001 ================================================================================ Title: Adobe Acrobat Script Injection Version: 1.0 Issue type: Script Injection Affected vendor...
Cross-domain data theft with CSS load
CSS can be loaded cross-domain, and in some cases it is be possible to read the data pointed to, leading to the possibility of cross-domain data theft...
Cross-domain data theft with CSS load – Opera Security Advisories
Cross-domain data theft with CSS load – Opera Security Advisories OPCOM Team | January 11, 2010 Summary CSS can be loaded cross-domain, and in some cases it is be possible to read the data pointed to, leading to the possibility of cross-domain data theft. Severity Moderate Opera’s response Opera...
Debian: Security Advisory (DSA-1951-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing
------------------------------------------------------------------------ Debian Security Advisory DSA-1951-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 15, 2009 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1951-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 15, 2009 http://www.debian.org/security/faq -...
Internet Explorer Request Header Cross-Domain Information Disclosure (MS08-031; CVE-2008-1544)
An information disclosure vulnerability has been reported in the way that Internet Explorer handles certain request headers. The vulnerability is due to an error in Internet Explorer that incorrectly parses a specially crafted request header, allowing a violation of the same origin policy. To...
Firefox Sage extension RSS feeds cross-domain scripting vulnerability-vulnerability warning-the black bar safety net
Affected version: Mozilla Sage 1.4.3 vulnerability description: BUGTRAQ ID: 3 7 1 2 0 CVECAN ID: CVE-2 0 0 9-4 1 0 2 Sage is a Firefox the use of lightweight RSS and Atom aggregator Controller extension. Sage does not correctly filter the RSS feeds in the description tag input will be used to...
CVE-2009-4102
Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed...
CVE-2009-4101
infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed...
CVE-2009-4100
Yoono extension before 6.1.1 for Firefox performs certain operations with chrome privileges, which allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload...
Cross site scripting
Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed...
Cross site scripting
Yoono extension before 6.1.1 for Firefox performs certain operations with chrome privileges, which allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload...
CVE-2009-4101
CVE-2009-4101 affects infoRSS for Firefox (1.1.4.2 and earlier). The extension processes the RSS feed description with chrome privileges, enabling remote attackers to execute arbitrary commands and perform cross-domain scripting via the description tag. Affected: infoRSS Firefox extension; impact...
CVE-2009-4100
The CVE-2009-4100 issue affects the Yoono extension for Firefox prior to version 6.1.1, where operations with chrome privileges allow user-assisted remote attackers to execute arbitrary commands and conduct cross-domain scripting via DOM event handlers (e.g., onload). Mitigation per sources is to...
CVE-2009-4101
infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed...