Opera Web浏览器10.01之前版本多个安全漏洞

BUGTRAQ ID: 36850 Opera是一款流行的WEB浏览器，支持多种平台。 Opera的10.01之前版本中存在多个安全漏洞，可能允许恶意用户读取敏感信息、执行任意指令或执行欺骗攻击。 1 处理域名时的内存破坏可能导致执行任意代码。 2 Opera可能允许在源订阅页面上运行脚本以获得对源对象的访问，这可能导致自动订阅源或读取其他源。 3 在Windows上处理Web字体时的错误可能导致更改地址字段的字体，在地址中显示任意域名。 Opera Software Opera Web Browser 10.01 厂商补丁： Opera Software --------------...

Code Execution Bug Bites Opera Browser

On the same day Mozilla shipped a Firefox update to fix multiple critical vulnerabilities, Opera dropped a major patch to fix three documented flaws, including a memory corruption issue that exposes users to code execution attacks. Here are the raw details: Advisory 1: Specially crafted domain...

Opera < 10.01 Multiple Vulnerabilities

Binary data 5217.prm...

opera -- multiple vulnerabilities

Opera Team Reports: Fixed an issue where certain domain names could allow execution of arbitrary code, as reported by Chris Weber of Casaba Security Fixed an issue where scripts can run on the feed subscription page, as reported by Inferno...

Opera may allow scripts to access feeds

Opera may allow scripts to run on the feed subscription page, thereby gaining access to the feeds object. This can be used for automatic subscription of feeds, or reading other feeds...

CVE-2009-3568

Comment RSS 5.x before 5.x-2.2 and 6.x before 6.x-2.2, a module for Drupal, does not properly enforce permissions when a link is added to the RSS feed, which allows remote attackers to obtain the node title and possibly other sensitive content by reading the feed...

Microsoft Windows Vista Feed Headlines Gadget Code Execution (MS07-048; CVE-2007-3033)

Gadgets are mini applications with a variety of possible uses. They can connect to web services to deliver business data, weather information, news updates, traffic maps, Internet radio streams, and even slide shows of on-line photo albums. Windows Vista is shipped with a set of gadgets, includin...

WordPress RSS feed Generator self_link HTTP_HOST Cross-Site Scripting (CVE-2008-5278)

WordPress is an opensource php-based blog publishing platform. It offers several features such as multi-author editing capability, automatic formatting of text and an architecture which supports plugins to further extend its functionality. There exists a cross-site script insertion vulnerability ...

Google Chrome RSS Or Atom Feed Cross-Site Scripting Vulnerability

This host is installed with Google Chrome and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: secpodgooglechromerssnatomxssvuln.nasl 5055 2017-01-20 14:08:39Z teissa $ Google Chrome RSS Or Atom Feed Cross-Site Scripting Vulnerability Authors: Sharath S Copyright:...

Opera Multiple Cross-Site Scripting Vulnerabilities (Sep 2009) - Linux

Opera is prone to multiple Cross-Site Scripting vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

Cross site scripting

Opera before 10.01 does not properly restrict HTML in a 1 RSS or 2 Atom feed, which allows remote attackers to conduct cross-site scripting XSS attacks, and conduct cross-zone scripting attacks involving the Feed Subscription Page to read feeds or create feed subscriptions, via a crafted feed,...

CVE-2009-3266

Opera before 10.01 is vulnerable to cross-site scripting via crafted RSS/Atom feeds due to improper HTML restriction when processing application/rss+xml as scripted content. This can enable remote XSS and cross-zone scripting on the Feed Subscription Page to read feeds or create subscriptions. Af...

CVE-2009-3265

Opera 9.x/10.x is affected by CVE-2009-3265, a Cross-site scripting (XSS) flaw where rendering of RSS/Atom feeds as scripted content enables injection of arbitrary script/HTML. The underlying issue is the handling of application/rss+xml as scripted content. The vendor reportedly viewed this as a ...

CVE-2009-3263

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3248

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...

CVE-2009-3248

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...

CVE-2009-3248

The CVE-2009-3248 entry describes a CSRF vulnerability in the vtiger CRM 5.0.4 RSS module . The flaw allows remote attackers to hijack the authentication of Admin users by crafting requests to index.php with the rssurl parameter in a Save action, enabling modification of the news feed system. The...

Cross site scripting

Cross-site scripting XSS vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed...