CVE-2012-5792

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Design/Logic Flaw

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5792

The CVE-2012-5792 entry affects the Sage Pay Direct module in osCommerce. The vulnerability arises because the module does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName, enabling MITM attackers to spoof SSL servers using an arbitrary valid cer...

CVE-2012-5792

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Slideshow: How to Avoid Getting Hacked While Traveling

VIEW SLIDESHOW How to Avoid Getting Hacked While Traveling Researcher Justin Morehouse has logged more than 100,000 miles to eight countries in the last year. His message: business travelers are at greater risk of being hacked than ever before, especially when it comes to smart phones and tablets...

Cross site scripting

Cross-site scripting XSS vulnerability in the Sage add-on 1.3.10 and earlier for Firefox allows remote attackers to inject arbitrary web script or HTML via a crafted feed, a different vulnerability than CVE-2009-4102...

CVE-2011-3384

Cross-site scripting XSS vulnerability in the Sage add-on 1.3.10 and earlier for Firefox allows remote attackers to inject arbitrary web script or HTML via a crafted feed, a different vulnerability than CVE-2009-4102...

CVE-2011-3384

CVE-2011-3384 affects the Sage Firefox add-on (versions 1.3.10 and earlier). The root cause is improper processing during HTML page output based on feed information, enabling a cross-site scripting (XSS) vulnerability that could allow arbitrary scripts to run in the user’s browser. The documented...

Sage vulnerable to arbitrary script execution

Overview Sage is vulnerable to arbitrary script execution. Note that this vulnerability is different from JVN30221194. Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output...

Sage vulnerable to arbitrary script execution

Overview Sage is vulnerable to arbitrary script execution. Note that this vulnerability is different from JVN99203127. Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output...

JVN#99203127: Sage vulnerable to arbitrary script execution

Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's Mozilla...

JVN#30221194: Sage vulnerable to arbitrary script execution

Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's Mozilla...

SA-CONTRIB-2010-077 - Sage Pay (former Protx) Direct Payment Gateway for Ubercart - Information Disclosure

The Sage Pay Direct Payment Gateway for Ubercart ucprotxvspdirect processes credit card transactions in Ubercart stores using the Sage Pay Direct service. The module may show remote 3-D Secure pages to the user in an iframe when their bank supports the Verified by Visa or MasterCard SecureCode...

Debian DSA-1951-1 : firefox-sage - insufficient input sanitising

It was discovered that firefox-sage, a lightweight RSS and Atom feed reader for Firefox, does not sanitise the RSS feed information correctly, which makes it prone to a cross-site scripting and a cross-domain scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian Security Advisory DSA 1951-1 (firefox-sage)

The remote host is missing an update to firefox-sage announced via advisory DSA 1951-1. OpenVAS Vulnerability Test $Id: deb19511.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1951-1 firefox-sage Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft In...

Debian: Security Advisory (DSA-1951-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing

------------------------------------------------------------------------ Debian Security Advisory DSA-1951-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 15, 2009 http://www.debian.org/security/faq -...

DSA-1951-1 firefox-sage - insufficient input sanitizing

Bulletin has no description...

firefox-sage RSS reader crossite scripting

It's possible to inject script into RSS data...

[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1951-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 15, 2009 http://www.debian.org/security/faq -...