Code injection

The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a denial of service crash via a web page containing a long string following a refresh tag, which triggers a floating point exception...

CVE-2009-5098

The CVE-2009-5098 issue affects Palm Pre WebOS 1.1 and earlier, specifically the LunaSysMgr process. A web page containing a long string after a refresh tag can trigger a floating point exception when the device is not in landscape mode, allowing remote attackers to cause a denial of service (cra...

CVE-2009-5098

The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a denial of service crash via a web page containing a long string following a refresh tag, which triggers a floating point exception...

CVE-2009-5097

Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3...

CVE-2009-5097

Technical details (affected software versions, root cause, exploitation status, and fixes) are not provided in the connected documents; monitor for updates.

CVE-2009-5097: Improper Control of Generation of Code

Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3...

CVE-2009-5098: Undefined Security Weakness

The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a denial of service crash via a web page containing a long string following a refresh tag, which triggers a floating point exception...

HP Palm WebOS crossite scripting

Crossite scripting in Contacts and Calendar applications...

CVE-2011-2409

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2408

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2408

CVE-2011-2408 affects HP webOS 3.x, specifically the Contacts application, where an XSS vulnerability exists in the Contacts UI before version 3.0.2. The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. HP security bulletin HPSBGN02694 rev.1 notes affec...

CVE-2011-2409

The CVE-2011-2409 issue affects HP webOS Calendar on HP Palm webOS 3.x prior to 3.0.2. The vulnerability is a Cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Reported impact indicates potential for arbitrary HTML/JavaScr...

CVE-2011-2408

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2409

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2408: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-1738

HP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit PDK applications, which allows local users to gain privileges by leveraging unintended filesystem write access...

CVE-2011-1737

Multiple cross-site scripting XSS vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...