1452 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to...
CVE-2009-1689
Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to...
CVE-2009-1689
Removed by vendor...
CVE-2009-1688
Removed by vendor...
CVE-2009-1688
CVE-2009-1688 is a WebKit-based XSS vulnerability affecting Apple Safari up to version 4.0 (and iPhone OS 1.0–2.2.1, iPod touch 1.1–2.2.1). The issue arises from WebKit not using the HTML5 standard method to determine the security context, enabling remote attackers to inject arbitrary script or H...
Microsoft Internet Explorer Event Handler Memory Corruption Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists when repeatedly calling event handle...
iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem/workqueue_removeitem Index Validation Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. BACKGROUND Mac OS X is a computer operating systems available from Apple Inc. OS X is the tenth major version of Apple's operating system for...
Novell GroupWise < 7.03HP2 / 8.0HP1 WebAccess Multiple XSS
The version of Novell GroupWise WebAccess installed on the remote host fails to sanitize user-supplied input via a POST request to the 'User.id' parameter of the '/gw/webacc' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject arbitrary...
PR08-23: XSS on Novell GroupWise WebAccess
PR08-23: XSS on Novell GroupWise WebAccess Vulnerability found: 2nd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: Medium Credits: Richard Brain of ProCheckUp Ltd www.procheckup.com. ProCheckUp thanks Novell for working with us in such a...
Update Protection against MW6 Technologies Barcode.dll ActiveX Control Buffer Overflow
A buffer overflow vulnerability was reported in Barocade, a software provided by MW6 Technologies. The vulnerability is due to a boundary error while processing user input. A remote attacker can exploit this vulnerability by convincing the user to open a crafted html file. Successful exploitation...
Oracle Application Server Portal 10g Cross Site Scripting Vulnerability
OracleAS Portal is a Web-based application for building and deploying portals. It provides a secure, manageable environment for accessing and interacting with enterprise software services and information resources. A vulnerability has been identified in Oracle Application Server 10g, This could b...
Mono ASP.NET action Attribute XSS
The remote host is running Mono, an open source, UNIX implementation of the Microsoft .NET development platform. The version of Mono installed on the remote host fails to encode user-supplied input to the URL before using it for the default 'action' of a form. An attacker may be able to leverage...
Apache Roller q Parameter XSS
The remote host is running Apache Roller, a multi-user blog server written in Java. The version of Apache Roller installed on the remote host fails to sanitize user input to the 'q' parameter of search requests before including it in dynamic HTML output. An attacker may be able to leverage this...
Kerio MailServer < 6.6.2 (KSEC-2008-12-16-01) Multiple XSS
Binary data 4797.prm...
Image properties can be used to execute scripts
Image properties can contain custom comments. When displaying the image properties, Opera can be tricked into treating the comments as script. This can cause the script to be run in the wrong security context...
Image properties can be used to execute scripts – Opera Security Advisories
Image properties can be used to execute scripts – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Highly Severe Problem Description Image properties can contain custom comments. When displaying the image properties, Opera can be tricked into treating the comments as script. This...
Built-in XSLT templates can allow cross-site scripting
Built-in XSLT templates incorrectly handle escaped content and can cause it to be treated as markup. If a site accepts content from untrusted users, which it then displays using XSLT as escaped strings, this can allow scripted markup to be injected. The scripts will then be executed in the securi...
WordPress wp-includes/feed.php self_link() Function Host Header RSS Feed XSS
The version of WordPress installed on the remote host fails to properly sanitize input to the 'Host' request header before using it in the 'selflink' function in 'wp-includes/feed.php' to generate dynamic HTML output. An attacker can leverage this issue to inject arbitrary HTML and script code in...
Sphider query Parameter Cross-Site Scripting Vulnerability
Sphider is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...