XSS and local file access by opening blocked popupsand local file access by opening blocked popups — Mozilla

shutdown reported that if you could convince a user to open a blocked popup you could perform a cross-site scripting attack against any site that contains a frame whose source is a data: URL. To accomplish this the attacker's site would have to frame the target site plus another frame whose sourc...

CVE-2007-0800

Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup...

[Full-disclosure] Firefox + popup blocker + XMLHttpRequest + srand() = oops

There is an interesting vulnerability in the default behavior of Firefox builtin popup blocker. This vulnerability, coupled with an additional trick, allows the attacker to read arbitrary user-accessible files on the system, and thus steal some fairly sensitive information. This was tested on...

Microsoft Internet Explorer 7 - Popup Address Bar Spoofing

function StartTest var padding = ''; for i=0 ; i milw0rm.com 2006-10-26...

Microsoft Internet Explorer 7弹出窗口地址栏欺骗漏洞

Internet Explorer是微软发布的非常流行的WEB浏览器。 IE 7在处理URL中字符串时存在漏洞，远程攻击者可能利用此漏洞引导用户执行恶意操作。 如果用户跟随了恶意链接的话，Internet Explorer所显示的弹出窗口中地址栏的URL可能会附加有一些特殊的字符。这可能导致只显示部分地址栏，诱骗用户执行非预期的操作。 Microsoft Internet Explorer 7.0 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/windows/ie/default.asp...

CVE-2006-4569

The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting XSS attacks...

DEBIAN-CVE-2006-4569

The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting XSS attacks...

CVE-2006-4569

The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting XSS attacks...

CVE-2006-4569

The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting XSS attacks...

CVE-2006-4569

CVE-2006-4569 relates to Firefox’s popup blocker: the “blocked popups” display could be shown in the Location bar instead of the originating frame, potentially enabling remote user‑assisted XSS. The connected advisories confirm this vulnerability in Mozilla Firefox up to version 1.5.0.6 and indic...

CVE-2006-4569

The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting XSS attacks...

CVE-2006-4569: Undefined Security Weakness

The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting XSS attacks...

Popup-blocker cross-site scripting (XSS) — Mozilla

shutdown demonstrated that blocked popups opened from the status bar "blocked popups" icon were always opened in the context of the site listed in the Location address bar, even if the blocked popup were originally opened by a subframe loaded from another site. This allows the popup to perform a...

popupSQL.txt

By:BoNy-m [email protected] ---------------------- example:- /popup/calendaryear.php?rentalid=SQL Injection...

popup Vacation Rentals[calendar_year.php] SQL Injection

By:BoNy-m [email protected] ---------------------- example:- /popup/calendaryear.php?rentalid=SQL Injection...

multiple Xss exploits in 35mmslidegallery V6

multiple Xss exploits in 35mmslidegallery V6 forum type : 35mmslidegallery V6 bug found by : black-code team : $!T3-D0WN type : Xss exploits : http://example.com/lumet/album/index.php?imgdir='scriptalert10/script http://example.comr/lumet/album/popup.php?w='scriptalert10/script...

CVE-2006-2141

Cross-site scripting XSS vulnerability in popupimage in Collaborative Portal Server CPS 3.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the pos argument...

security flaw

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site...

security flaw

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site...

Design/Logic Flaw

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site...