jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload GRO implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization RHEV Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

Code injection

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

Design/Logic Flaw

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Google Chrome on Linux (pre-13.0.782.107) is affected by CVE-2011-2782 due to a drag-and-drop file permission handling flaw that could allow a user‑assisted remote attacker to bypass access restrictions via unspecified vectors. The issue is addressed in Chrome 13.0.782.107 (Stable Channel update)...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Removed by vendor...

kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload GRO implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization RHEV Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

Spam Profits Down, Cybercrooks Flock to Targeted Attacks

HED: Report: Spam Profits Down, Cybercrooks Flock to Targeted Attacks DEK: A report from Cisco Systems suggests that cybercriminals are abandoning spamming for targeted attacks, which are more profitable. A new report from Cisco Systems Inc. analyzing illegal activities from spammers and other...

Mt.Gox взломан

Mt. Gox — одна из крупнейших Bitcoin бирж, позволяющих обменивать «цифровое золото» на вполне реальные деньги. В результате взлома в руки злоумышленников попали данные о пароле в зашифрованном виде, логине и почте пользователей. После взлома, пока по непонятной причине, курс биткоинов на бирже...

CVE-2011-1258

Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different 1 domain or 2 zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."...

Information disclosure

Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different 1 domain or 2 zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."...

CVE-2011-1258

CVE-2011-1258 affects Microsoft Internet Explorer 6–8. The vulnerability arises from improper restriction of web scripting, enabling a user‑assisted attacker to disclose sensitive information from a different domain/zone via drag‑and‑drop. Impact is partial confidentiality loss. Remediation: appl...

CVE-2011-1258

Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different 1 domain or 2 zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."...