450 matches found
Fast Forward can allow cross-site scripting – Opera Security Advisories
Fast Forward can allow cross-site scripting – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Highly Severe Platforms All desktop versions Problem Description If a link that uses a JavaScript URL triggers Opera’s Fast Forward feature, when the user activates Fast Forward, the...
Fast Forward can allow cross-site scripting
If a link that uses a JavaScript URL triggers Opera's Fast Forward feature, when the user activates Fast Forward, the script should run on the current page. When a page is held in a frame, the script is incorrectly executed on the outermost page, not the page where the URL was located. This can b...
Opera Web浏览器HTML注入及跨站脚本漏洞
BUGTRAQ ID: 31842 Opera是一款流行的WEB浏览器，支持多种平台。 Opera的9.61之前版本中的多个安全漏洞可能允许恶意用户执行脚本注入攻击、绕过某些安全限制或泄露敏感信息。 1 History Search功能没有正确地过滤某些输入，用户在查看恶意数据时可能在用户的浏览器会话中注入任意HTML和脚本代码，导致泄露之前所访问的页面。 2 实现Fast Forward功能中的错误可能允许通过特制的JavaScript URL在受限制的帧中执行任意脚本代码。 3 在预览新闻源期间时阻断脚本存在错误，可能导致泄露所订阅新闻源的内容，或将用户订阅到任意的新闻源。 Oper...
CVE-2008-4697: Improper Neutralization of Input During Web Page Generation
The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains this URL, which allows remote attackers to conduct cross-site scripting XSS attacks...
opera -- multiple vulnerabilities
Opera reports: Certain constructs are not escaped correctly by Opera's History Search results. These can be used to inject scripts into the page, which can then be used to look through the user's browsing history, including the contents of the pages they have visited. These may contain sensitive...
CVE-2008-1002: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Apple Safari before 3.1 allows remote attackers to inject arbitrary web script or HTML via a crafted javascript: URL...
CVE-2002-2386: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the SRC attribute of an IMG tag...
CVE-2002-2339: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in 1 image, 2 img, 3 image=right, 4 img=right, 5 image=left, and 6 img=left tags...
CVE-2002-2314
Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which causes the host/path check to fail...
CVE-2002-2314: Improper Input Validation
Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which causes the host/path check to fail...
CVE-2003-1453: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag...
CVE-2002-2230
CVE-2002-2230 describes an XSS vulnerability in Ikonboard 3.1.1 where remote attackers can inject arbitrary script via a private message containing a javascript: URL in an IMG tag, with the URL ending in ".gif" or ".jpg". The connected Red Hat CVE entry confirms this issue as a cross-site scripti...
CVE-2002-2230: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via a private message with a javascript: URL in the IMG tag, in which the URL ends in a ".gif" or ".jpg" string, a variant of CVE-2002-0328...
CVE-2002-2231: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL in a photo URL or 2 an X-Forwarded-For: header...
security flaw
Cross-site scripting XSS vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into 1 performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or 2 selecting "Show on...
security flaw
Cross-site scripting XSS vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into 1 performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or 2 selecting "Show on...
Cross site scripting
Cross-site scripting XSS vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into 1 performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or 2 selecting "Show on...
CVE-2006-2785
Cross-site scripting XSS vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into 1 performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or 2 selecting "Show on...
CVE-2006-2784
The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested javascript: URLs. NOTE: the manual install button is use...
CVE-2006-2785
Cross-site scripting XSS vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into 1 performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or 2 selecting "Show on...