firefox/thunderbird/seamonkey: XSS using addEventListener and setTimeout on a wrapped object (MFSA 2010-12)

Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting XSS attacks, by using the addEventListener and setTimeo...

firefox/thunderbird/seamonkey: XSS using addEventListener and setTimeout on a wrapped object (MFSA 2010-12)

Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting XSS attacks, by using the addEventListener and setTimeo...

Chrome Password Manager Cross Origin Weakness (CVE-2010-0556)

Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Chrome Password Manager Cross Origin Weakness Release Date: 2010-02-15 Application: Google Chrome Web Browser Versions:...

Yoono Firefox Extension - Privileged Code Injection

, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Yoono Firefox Extension Code Injection Vulnerability Versions affected: 6.1.1 +-----------+ |Description| +-----------+ The Yoono Firefox extension provides an interface for users t...

Google Chrome Frame < 4.0.245.1

The version of Google Chrome Frame installed on the remote host is earlier than 4.0.245.1. Such versions are affected by a vulnerability that may allow an attacker to bypass cross-origin protections. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Microsoft Finds Security Flaw in Google Chrome Frame

Back in September, when Google launched the Google Chrome Frame plug-in for Internet Explorer users, Microsoft immediately warned that the move would increase the attack surface and make IE users less secure. Now comes word that a security researcher in the Microsoft Vulnerability Research MSVR h...

Fedora Core 12 FEDORA-2009-11487 (qt)

The remote host is missing an update to qt announced via advisory FEDORA-2009-11487. OpenVAS Vulnerability Test $Id: fcore200911487.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-11487 qt Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft In...

Fedora Core 10 FEDORA-2009-11488 (qt)

The remote host is missing an update to qt announced via advisory FEDORA-2009-11488. OpenVAS Vulnerability Test $Id: fcore200911488.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-11488 qt Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft In...

Fedora Core 11 FEDORA-2009-11491 (qt)

The remote host is missing an update to qt announced via advisory FEDORA-2009-11491. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora 12 : qt-4.5.3-9.fc12 (2009-11487)

A security flaw was found in the WebKit's Cross-Origin Resource Sharing CORS implementation. Multiple security flaws integer underflow, invalid pointer dereference, buffer underflow and a denial of service were found in the way WebKit's FTP parser used to process remote FTP directory listings. No...

Fedora 10 : qt-4.5.3-9.fc10 (2009-11488)

A security flaw was found in the WebKit's Cross-Origin Resource Sharing CORS implementation. Multiple security flaws integer underflow, invalid pointer dereference, buffer underflow and a denial of service were found in the way WebKit's FTP parser used to process remote FTP directory listings. No...

CVE-2009-2816

The implementation of Cross-Origin Resource Sharing CORS in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to...

Cross site request forgery (csrf)

The implementation of Cross-Origin Resource Sharing CORS in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to...

CVE-2009-2816

The implementation of Cross-Origin Resource Sharing CORS in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to...

CVE-2009-2816

Technical details for CVE-2009-2816 are not provided in the connected documents. The materials mention WebKit/CORS context and related products, but no concrete exploit specifics, impacted versions, or fixes are included. Monitor for updates.

CVE-2009-2816

The implementation of Cross-Origin Resource Sharing CORS in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to...

Mac OS X : Apple Safari < 4.0.4

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.4. As such, it is potentially affected by several issues : - Multiple use-after-free issues exist in libxml2, the most serious of which could lead to a program crash. CVE-2009-2414, CVE-2009-2416 - An issue in t...

Safari < 4.0.4 Multiple Vulnerabilities

Binary data 801003.prm...

Safari < 4.0.4 Multiple Vulnerabilities

Binary data 5232.prm...

Mozilla Issues Critical Firefox Security Bulletins

Mozilla has released Firefox 3.5.4 with fixes for a wide range of serious security vulnerabilities. The most serious issue could allow a malicious hacker to take complete control of a computer by simply tricking a user into visiting a rigged Web page. In all, Mozilla released 11 advisories, six...