2338 matches found
Mozilla fails to properly prevent "JavaScript:" URIs containing "eval()" from being executed in the context of other URIs in the history list
Overview Mozilla fails to properly restrict the execution of javascript: URIs. The impact is similar to that of a cross-site scripting vulnerability, which allows an attacker to access data in other sites. Description Mozilla uses a same origin security model to maintain separation between browse...
security flaw
Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window...
security flaw
Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system...
security flaw
Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka t...
VulnCheck KEV: CVE-2004-1319
The DHTML Edit Control dhtmled.ocx allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as...
Microsoft Internet Explorer contains URL decoding cross-domain vulnerability
Overview A URL decoding vulnerability in Microsoft Internet Explorer may allow remote attackers to bypass zone security restrictions and execute arbitrary code on affected systems. Description IE uses a cross-domain security model to maintain separation between browser frames from different...
US-CERT Technical Cyber Security Alert TA05-012B -- Microsoft Windows HTML Help ActiveX Contol Cross-Domain Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA05-012B Microsoft Windows HTML Help ActiveX Contol Cross-Domain Vulnerability Original release date: January 12, 2005 Last revised: -- Source: US-CERT Systems Affected Windows 98, Me, 2000, XP, and Server 2003 Internet...
Microsoft Windows HTML Help ActiveX control does not adequately validate window source
Overview The Microsoft Windows HTML Help ActiveX control contains a cross-domain vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands or code with the privileges of the user running the control. The HTML Help control can be instantiated by an HTML...
Microsoft Internet Explorer DHTML Editing ActiveX control contains a cross-domain vulnerability
Overview A cross-domain vulnerability exists in the DHTML Editing ActiveX control. An attacker may be able to execute arbitrary script in the Local Machine Zone or read or modify data in other domains. For example, the attacker could execute arbitrary commands with parameters, download and execut...
CVE-2004-1314
Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability, a different...
Netscape < 7.2 Cross-domain Window Injection
Binary data 2468.prm...
CVE-2004-1157: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Opera 7.x up to 7.54, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window...
CVE-2004-1158: Undefined Security Weakness
Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka t...
OmniWeb Browser Cross-Domain Dialog Box Spoofing
Binary data 2424.prm...
Internet Explorer HTML Help Control ActiveX Cross Domain/Zone Scripting Vulnerabilities
TITLE : Internet Explorer HTML Help Control ActiveX Cross Domain/Zone Scripting Vulnerabilities Criticality : Less Critical : WHERE : From remote Requires user interaction IMPACT : Security Bypass System Access Exposure of Sensitive Information SOFTWARE : Microsoft Internet Explorer 6 Tested on :...
Konqueror Cross-Domain Scripting
Binary data 2379.prm...
NetCaptor Cross-Domain Dialog Spoofing
Binary data 2376.prm...
Opera < 7.55.0 Cross-Domain Dialog Box Spoofing
Binary data 2373.prm...
Konqueror < 3.2.2-2 Cross-Domain Dialog Box Spoofing
Binary data 2374.prm...
Microsoft Internet Explorer does not properly handle function redirection
Overview Microsoft Internet Explorer IE fails to properly validate redirected functions. The impact is similar to that of a cross-site scripting vulnerability, which allows an attacker to access data in other sites, including the Local Machine Zone. Description IE features Active scripting, the...