Mozilla multiple cross origin wrapper bypasses

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting XSS attacks via a crafted document, related to a "cross origin wrapper bypass."...

Mozilla Foundation Security Advisory 2009-40

Mozilla Foundation Security Advisory 2009-40 Title: Multiple cross origin wrapper bypasses Impact: High Announced: July 21, 2009 Reporter: mozbugra4 Products: Firefox Fixed in: Firefox 3.5 Firefox 3.0.12 Description Mozilla security researcher mozbugra4 reported a series of vulnerabilities in whi...

CVE-2009-2472

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting XSS attacks via a crafted document, related to a "cross origin wrapper bypass."...

nsXMLHttpRequest:: NotifyEventListeners() same-origin violation

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass t...

浏览器内核漏洞导致的本地跨域漏洞

maxthon采用了系统的IE内核，但是该内核可能存在一些安全漏洞导致跨域攻击，而遨游的max:等的域是在本地等同于file://，所以这个跨域攻击将导致在本地上下文中执行javascript代码，这里只给出取得遨游浏览历史记录的POC。 maxthon 6.30 安装6.30新版本 Maxthon Exploit function win x=window.open"max:history"; setTimeoutfunction x.location=new...

Mozilla Firefox Chrome跨域安全绕过漏洞

Mozilla Firefox是一款开放源代码的WEB浏览器。 Mozilla Firefox存在绕过chrome安全限制问题，远程攻击者可以利用漏洞在任意域执行任意脚本代码。 通过使用NULL字符访问XUL文件，可导致跨域执行任意脚本代码，导致敏感信息泄露或访问其他域任意代码。 Mozilla Firefox 2.0.8 目前没有解决方案提供： http://www.mozilla.com/en-US/ script this.location = '\x00chrome://browser/content/browser.xul'; /script...

Firefox about:blank IFRME帧跨域访问漏洞

BUGTRAQ ID: 24286 CVECAN ID: CVE-2007-3089 Mozilla Firefox是一款流行的开源WEB浏览器。 Firefox在处理文件加载时存在漏洞，远程攻击者在特定情况下可能利用此漏洞欺骗地址栏方便执行钓鱼攻击。 在加载页面阶段或about:blank帧的情况下，Firefox允许使用document.write替换IFRAME帧。如果用户从脚本打开了窗口，在加载页面期间就可能在短时间内欺骗新打开窗口帧的内容，执行网络钓鱼类的攻击。 Mozilla Firefox 2.0.0.5 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

USN-149-1: Firefox vulnerabilities

Secunia.com reported that one of the recent security patches in Firefox reintroduced the frame injection patch that was originally known as CAN-2004-0718. This allowed a malicious web site to spoof the contents of other web sites. CAN-2005-1937 In several places the browser user interface did not...

security flaw

The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of t...

security flaw

Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords...