Firefox Malicious search plugins can inject code into arbitrary sites

Cross-site scripting XSS vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element...

Firefox 2 and 3 Layout engine crash

The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service application crash and possibly trigger memory corruption via vectors related to nsSVGElement::BindToTree...

MS Internet Explorer EMBED Memory Corruption PoC (MS09-014)

No description provided by source. BODY onload=go/BODY !-- MS09-014: MSIE EMBED element race condition memory corruption Code by SkyLined [email protected] http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html...

MS Internet Explorer EMBED Memory Corruption PoC (MS09-014)

Exploit for unknown platform in category dos / poc =========================================================== MS Internet Explorer EMBED Memory Corruption PoC MS09-014 =========================================================== var asMimeTypes = "x-world/x-3dmf", "x-world/x-3dmf",...

Microsoft Internet Explorer - EMBED Memory Corruption (PoC) (MS09-014)

http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption -- var asMimeTypes = "x-world/x-3dmf", "x-world/x-3dmf", "application/octet-stream", "application/x-authorware-bin",...

MS09-014: MSIE EMBED element race condition memory corruption

Some details + repro: http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption/ Cheers, SkyLined Berend-Jan Wever [email protected] http://skypher.com/SkyLined...

CVE-2009-1249

Cross-site scripting XSS vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map...

CVE-2009-1249

CVE-2009-1249: XSS in Drupal’s Feed element mapper 5.x before 5.x-1.1. The vulnerability affects the Feed element mapper module for Drupal, allowing remote attackers to inject arbitrary script/HTML via the content title at admin/content/node-type/nodetype/map. Root cause is insufficient validatio...

CVE-2009-1249: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map...

SA-CONTRIB-2009-018 - Feed element mapper - Cross site scripting

Feed element mapper is an Add-on module for FeedAPI that maps elements on a feed item such as tags or the author name to taxonomy or CCK fields. These mappings are configurable by point and click. The module does not escape content titles enabling malicious users to insert arbitrary HTML and...

Ubuntu: Security Advisory (USN-506-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSA-1751-1 xulrunner - several vulnerabilities

Bulletin has no description...

CVE-2009-0821

Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service application crash via nested calls to the window.print function, as demonstrated by a window.printwindow.print in the onclick attribute of an INPUT element...

CVE-2009-0821: Undefined Security Weakness

Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service application crash via nested calls to the window.print function, as demonstrated by a window.printwindow.print in the onclick attribute of an INPUT element...

libpng fails to properly initialize element pointers

Overview Libpng contains a vulnerability in the way element pointers are handled. Description A vulnerability in the way libpng handles element pointers may result in uninitialized element pointers. This vulnerability is due to an off-by-one error introduced in multiple functions in libpng-0.89c...

Cross site scripting

Cross-site scripting XSS vulnerability in ActionScript in arbitrary Shockwave Flash SWF files created by InfoSoft FusionCharts allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the dataURL parameter...

CVE-2008-6060

Cross-site scripting XSS vulnerability in ActionScript in arbitrary Shockwave Flash SWF files created by InfoSoft FusionCharts allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the dataURL parameter...

CVE-2009-0355

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element...

Firefox local file stealing with SessionStore

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element...

CVE-2009-0355

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element...