Trimble Navigation SketchUp BMP File Code Execution - Ver2 (CVE-2013-3663)

A remote code execution vulnerability exists in Trimble Navigation's SketchUp. The vulnerability is due to a heap buffer overflow while processing BMP files which contain malicious RLE data. Remote unauthenticated attackers can exploit this vulnerability by enticing a target user to open a...

Mozilla多个产品onbeforeunload事件页面导航拒绝服务漏洞

CVE ID:CVE-2014-1500 Mozilla Firefox/SeaMonkey是Mozilla所发布的WEB浏览器/新闻组客户端。 当onbeforeunload事件与页面导航一起使用时会使浏览器变得不稳定，允许攻击者利用漏洞构建恶意WEB页，诱使用户解析，可使应用程序崩溃。 0 Mozilla Firefox 27 Mozilla Seamonkey 2.24 Mozilla Firefox 28，Seamonkey 2.25已经修复该漏洞，建议用户下载更新： http://www.mozilla.org...

CVE-2014-1499

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC 1 camera or 2 microphone permission prompt by triggering navigation at a certain time during generation of this prompt...

onbeforeunload and Javascript navigation DOS — Mozilla

Security researchers Tim Philipp Schäfers and Sebastian Neef, the team of Internetwache.org, reported a mechanism using JavaScript onbeforeunload events with page navigation to prevent users from closing a malicious page's tab and causing the browser to become unresponsive. This allows for a deni...

CVE-2014-1884

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed 1 in an IFRAME element or 2 with the XMLHttpRequest...

Design/Logic Flaw

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed 1 in an IFRAME element or 2 with the XMLHttpRequest...

CVE-2014-1884

CVE-2014-1884 affects Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7/8. The root cause is improper restriction of navigation events, which lets remote attackers bypass device-resource restrictions when content is accessed (1) inside an iframe or (2) via t...

CVE-2014-1884

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed 1 in an IFRAME element or 2 with the XMLHttpRequest...

Then talk about DNS hijacking and other malicious acts-vulnerability warning-the black bar safety net

The past two years2012-2013, the 3 6 0 navigationhttp://hao.360.cncome into contact with a large number of hijacking cases. First by hijacking the effect and purpose is divided into the following 2 categories: jump hijack that user access 3 6 0 navigation, is forced to jump to other...

Sql injection

SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified...

Multiple SQL injection vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon contains multiple SQL injection vulnerabilities. Cybozu Garoon contains issues in the process of page navigation link and input through API, which may result in SQL injection. Note that this vulnerability is different from JVN60997973. Impact A user who can log in to the...

CVE-2013-5411

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors...

Code injection

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors...

CVE-2013-5611

Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation...

CVE-2013-5611

Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation...

Application Installation doorhanger persists on navigation — Mozilla

Mozilla developer Myk Melez reported that with specifically timed page navigation, the doorhanger notification for Web App installation could persist from one site to another without being dismissed by the navigation. This could be used by a malicious site to trick a user into installing an...

Trimble Navigation SketchUp BMP File Code Execution (CVE-2013-3663)

A remote code execution vulnerability has been reported in Trimble Navigation's SketchUp...

[SECURITY] Fedora 18 Update: php-symfony2-DomCrawler-2.2.10-1.fc18

The DomCrawler Component eases DOM navigation for HTML and XML documents...

CVE-2013-2908

Google Chrome before 30.0.1599.66 uses incorrect function calls to determine the values of NavigationEntry objects, which allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code...

CVE-2013-2915

Google Chrome before 30.0.1599.66 preserves pending NavigationEntry objects in certain invalid circumstances, which allows remote attackers to spoof the address bar via a URL with a malformed scheme, as demonstrated by a nonexistent:12121 URL...