2422 matches found
Firefox XML data theft via RDFXMLDataSource and cross-domain redirect
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect...
Firefox XML data theft via RDFXMLDataSource and cross-domain redirect
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect...
CVE-2009-0776: Exposure of Sensitive Information to an Unauthorized Actor
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect...
Mozilla Firefox < 3.0.7 Multiple Vulnerabilities
Binary data 4950.prm...
XML data theft via RDFXMLDataSource and cross-domain redirect — Mozilla
Mozilla security researcher Georgi Guninski reported that a website could use nsIRDFService and a cross-domain redirect to steal arbitrary XML data from another domain, a violation of the same-origin policy. This vulnerability could be used by a malicious website to steal private data from users...
Opera plugs code-execution vulnerabilities
Opera Software has shipped a high-priority security patch for its flagship Web browser to plug at least three vulnerabilities that expose Windows users to code execution and cross-domain scripting attacks. The Opera 9.64 upgrade also adds support for DEP Data Execution Prevention and ASLR Address...
Opera < 9.64 Multiple Vulnerabilities
The version of Opera installed on the remote host is earlier than 9.64 and thus reportedly affected by multiple issues : - A memory-corruption vulnerability when processing specially crafted JPEG files could allow an attacker to execute arbitrary code with the privileges of the affected...
CVE-2009-0354
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...
Cross site scripting
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...
CVE-2009-0354
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...
CVE-2009-0354
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...
CVE-2009-0354
CVE-2009-0354 : Mozilla Firefox 3.x prior to 3.0.6 contains a cross-domain vulnerability where a chrome XBL method used with window.eval can bypass the Same Origin Policy, enabling access to another window’s properties and potential XSS. Affected: Firefox 3.x up to 3.0.5. Impact: SOP bypass and c...
Firefox XSS using a chrome XBL method and window.eval
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...
CVE-2009-0354: Improper Neutralization of Input During Web Page Generation
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting XSS attacks, via vectors involving a chrome XBL method and the window.eval...
Cross site scripting
Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin Policy via a crafted script that accesses another frame and reads its full URL and possibly other sensitive information, or modifies the URL of this frame...
CVE-2009-0276
Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin Policy via a crafted script that accesses another frame and reads its full URL and possibly other sensitive information, or modifies the URL of this frame...
CVE-2009-0276
CVE-2009-0276 affects Google Chrome (V8 JavaScript engine) prior to 1.0.154.46. A cross-domain vulnerability lets a crafted script bypass the Same Origin Policy, enabling reading the full URL of another frame and potentially other sensitive data, or modifying the URL of the target frame. The vuln...
CVE-2009-0276
Removed by vendor...
CVE-2009-0276: Undefined Security Weakness
Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin Policy via a crafted script that accesses another frame and reads its full URL and possibly other sensitive information, or modifies the URL of this frame...