CVE-2008-1448

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via...

CVE-2008-1448

Technical details for CVE-2008-1448 are not provided in the connected documents. Public details are limited to related CVEs; monitor for updates.

Microsoft IE帧位置绕过跨域安全限制漏洞

BUGTRAQ ID: 29986 Internet Explorer是微软发布的非常流行的WEB浏览器。 Internet Explorer没有正确地限制对文档帧的访问。攻击者可以用任意内容替换网页的帧的内容，Internet Explorer看起来仍在强制跨域安全模型限制恶意帧可对父文档所执行的操作。例如，其他域中的帧不可以访问父文档的cookies、HTML内容或其他帧特定的DOM组件，但组件是不受特定域约束的，如onmousedown事件。通过监控这个特殊的事件，IFRAME就可以从父文档捕获键盘输入，或执行其他恶意攻击。 Microsoft Internet Explorer...

Surf fixes a few security vulnerabilities-vulnerability warning-the black bar safety net

In 80sec notification to travel into the presence of the security vulnerability after that, surf to 6. 3 0 released a new version of the browser, fixes the previously mentioned security vulnerability, the specific update can be found http://blog. maxthon. cn/, the update fixes three security...

CVE-2008-2947

Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a 1 location or 2 location.href property, related to incorrect determination of t...

Cross site scripting

Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2008-2949

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

Cross site scripting

Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a 1 location or 2 location.href property, related to incorrect determination of t...

Cross site scripting

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2008-2948

Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2008-2947

Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a 1 location or 2 location.href property, related to incorrect determination of t...

CVE-2008-2948

Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2008-2948

CVE-2008-2948 is documented as a cross-domain vulnerability in Internet Explorer, described as a duplicate/related attack to CVE-2008-2947. The connected sources indicate it affects IE, involves window location cross-domain handling via the Object data type, and is tied to the same family of vuln...

CVE-2008-2949

CVE-2008-2949 describes a cross-domain vulnerability in Internet Explorer 6 and 7 where the attacker could manipulate the window.location object using a String to observe events across domains. The root cause is the incorrect determination of the origin of web script, enabling potential viewing o...

CVE-2008-2949

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2008-2947

CVE-2008-2947 describes a cross-domain vulnerability in Internet Explorer (IE 5.01 SP4 on Windows 2000 SP4, IE6 SP1 on Windows 2000/XP, IE6/IE7 on various Windows editions, and IE7) where JavaScript can abuse the Window Location object due to incorrect origin determination, leading to remote code...

CVE-2008-2947: Improper Access Control

Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a 1 location or 2 location.href property, related to incorrect determination of t...

CVE-2008-2949: Undefined Security Weakness

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2008-2948: Undefined Security Weakness

Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

Window of the world browser such as local xss cross-domain vulnerability POC-vulnerability warning-the black bar safety net

Vulnerability description: http://www.80sec.com/360-sec-browser-localzone-xss. html Document source:http://www. 80sec. com/release/The-world-browser-locale-zone-xss-POC.txt Vulnerability analysis: the window of the world browser in the start page is res://E:\PROGRA1\THEWOR1.0\LANGUAGES\CHS.DLL...