Design/Logic Flaw

Apple Safari before 9.1 allows remote attackers to spoof the user interface via a web page that places text in a crafted context, leading to unintended use of that text within a Safari dialog...

CVE-2009-2197

Apple Safari before 9.1 allows remote attackers to spoof the user interface via a web page that places text in a crafted context, leading to unintended use of that text within a Safari dialog...

CVE-2009-2197: Undefined Security Weakness

Apple Safari before 9.1 allows remote attackers to spoof the user interface via a web page that places text in a crafted context, leading to unintended use of that text within a Safari dialog...

PT-2016-1605

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9.1 Description The issue is related to incorrect data handling. It may allow a remote attacker to substitute the user interface by using a web page that places text in a crafted context, leading to unintended us...

CVE-2016-0955

Cross-site scripting XSS vulnerability in Adobe Experience Manager AEM 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe Experience Manager AEM 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog...

CVE-2016-0955

CVE-2016-0955 affects Adobe Experience Manager (AEM) 6.1.0. It is a cross-site scripting (XSS) vulnerability in the Deletion popup dialog where a folder title field is mishandled, allowing a remote authenticated user to inject arbitrary web script or HTML. The issue is confirmed in multiple feeds...

PT-2016-4485

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager version 6.1.0 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog...

CVE-2016-0955: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe Experience Manager AEM 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog...

Unspecified vulnerability in Mozilla Firefox protocol-handler dialog box

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in the protocol-handler dialog box in Mozilla Firefox versions prior to 44.0. The vulnerability can be exploited by remote attackers to conduct clickjacking...

Mozilla Firefox Clickjacking Attack Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in the file-download dialog box in versions of Mozilla Firefox prior to 44.0 on the OS X platform, which is caused by a short interval between when the dialog bo...

CVE-2016-1941

The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

CVE-2016-1937

The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

CVE-2016-1941

The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

PT-2016-4933

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 44.0 Description The issue allows remote attackers to conduct clickjacking attacks via a crafted web site. This is due to the file-download dialog enabling a certain button too quickly, triggering a single-cli...

CVE-2016-1941: Improper Neutralization of Input During Web Page Generation

The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

CVE-2016-1937: Improper Neutralization of Input During Web Page Generation

The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

KLA10748 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, spoof user interface and execute arbitrary code. Below is a complete list of vulnerabilities 1. Multiple memory safety...

Delay following click events in file download dialog too short on OS X — Mozilla

Security researcher Jordi Chancel reported an issue on OS X where the delay between the download dialog getting focus and the button getting enabled was too short. If an attacker is able to induce the user to double-click in a specific location, they can then pass the second click through to the...

Missing delay following user click events in protocol handler dialog — Mozilla

Security researcher window reported an issue where the protocol handler dialog appears, double click events are treated as two single click events. This was caused by the lack of a delay following the initial focus in the file download dialog. This could cause a second dialog to be sent the secon...