CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

Design/Logic Flaw

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Google Chrome on Linux (pre-13.0.782.107) is affected by CVE-2011-2782 due to a drag-and-drop file permission handling flaw that could allow a user‑assisted remote attacker to bypass access restrictions via unspecified vectors. The issue is addressed in Chrome 13.0.782.107 (Stable Channel update)...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

PT-2011-4085

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 13.0.782.107 Description The issue concerns the drag-and-drop implementation, which does not properly enforce permissions for files. This allows remote attackers to bypass intended access restrictions via...

CVE-2011-2782: Incorrect Default Permissions

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Removed by vendor...

kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload GRO implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization RHEV Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

CVE-2010-4555: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

PT-2011-1604

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.4.21 and earlier Description The issue involves multiple cross-site scripting XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can occur through various vectors, including...

Spam Profits Down, Cybercrooks Flock to Targeted Attacks

HED: Report: Spam Profits Down, Cybercrooks Flock to Targeted Attacks DEK: A report from Cisco Systems suggests that cybercriminals are abandoning spamming for targeted attacks, which are more profitable. A new report from Cisco Systems Inc. analyzing illegal activities from spammers and other...

Mt.Gox взломан

Mt. Gox — одна из крупнейших Bitcoin бирж, позволяющих обменивать «цифровое золото» на вполне реальные деньги. В результате взлома в руки злоумышленников попали данные о пароле в зашифрованном виде, логине и почте пользователей. После взлома, пока по непонятной причине, курс биткоинов на бирже...

CVE-2011-1258

Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different 1 domain or 2 zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."...

Information disclosure

Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different 1 domain or 2 zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."...

CVE-2011-1258

CVE-2011-1258 affects Microsoft Internet Explorer 6–8. The vulnerability arises from improper restriction of web scripting, enabling a user‑assisted attacker to disclose sensitive information from a different domain/zone via drag‑and‑drop. Impact is partial confidentiality loss. Remediation: appl...

CVE-2011-1258

Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different 1 domain or 2 zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability."...

PT-2011-2996

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 8 Description An information disclosure issue exists, allowing script to access information from a different domain or zone. This can be exploited by an attacker constructing a specially crafted w...

PT-2011-3617

Name of the Vulnerable Software and Affected Versions Adobe Shockwave NPAPI Plug-in affected versions not specified Description The issue is related to a remote code execution vulnerability in the Adobe Shockwave NPAPI Plug-in, specifically involving drag and drop functionality. Recommendations A...

Microsoft Internet Explorer拖放未初始化内存远程代码执行漏洞

Bugtraq ID: 48204 CVE ID：CVE-2011-1254 Microsoft Internet Explorer是一款微软开发的WEB浏览器。 Internet Explorer在处理某些内容上的拖放事件时存在释放后使用错误，攻击者可以构建恶意WEB页，诱使用户解析，破坏内存，成功利用漏洞可以以应用程序上下文执行任意代码。 Microsoft Internet Explorer 8 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6....