492 matches found
Microsoft Vista侧栏联系人及天气小工具远程代码执行漏洞（MS07-048）
BUGTRAQ ID: 25306,25304 CVECAN ID: CVE-2007-3891,CVE-2007-3032 Vista是微软发布的最新的操作系统。 Vista侧栏的联系人和天气小工具在解析某些属性时没有执行充分的验证，远程攻击者可能利用此漏洞通过诱使用户执行某些操作来控制系统。 如果用户在联系人小工具中导入添加了恶意的联系人文件，或单击了天气小工具中的恶意链接，就可能导致在系统上运行恶意代码。 Microsoft Windows Vista 临时解决方法： 卸载或禁用天气和联系人小工具 在“组策略”或注册表中禁用侧栏 修改gadget.xml上的访问控制列表以增加限制：...
[Full-disclosure] iDefense Security Advisory 08.14.07: Microsoft Windows Vista Sidebar RSS Feeds Gadget Cross Site Scripting Vulnerability
Microsoft Windows Vista Sidebar RSS Feeds Gadget Cross Site Scripting Vulnerability iDefense Security Advisory 08.14.07 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 14, 2007 I. BACKGROUND The Vista sidebar is a desktop extension that allows the user to keep a number of "gadgets",...
CVE-2007-2627
Cross-site scripting XSS vulnerability in sidebar.php in WordPress, when custom 404 pages that call getsidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string PHPSELF, a different vulnerability than CVE-2007-1622...
DEBIAN-CVE-2007-2627
Cross-site scripting XSS vulnerability in sidebar.php in WordPress, when custom 404 pages that call getsidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string PHPSELF, a different vulnerability than CVE-2007-1622...
CVE-2007-2627
Cross-site scripting XSS vulnerability in sidebar.php in WordPress, when custom 404 pages that call getsidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string PHPSELF, a different vulnerability than CVE-2007-1622...
MDKSA-2005:120-1 : mozilla-firefox
A number of vulnerabilities were reported and fixed in Firefox 1.0.5 and Mozilla 1.7.9. The following vulnerabilities have been backported and patched for this update: In several places the browser UI did not correctly distinguish between true user events, such as mouse clicks or keystrokes, and...
Fedora Core 3 : firefox-1.0.2-1.3.1 (2005-246)
A buffer overflow bug was found in the way Firefox processes GIF images. It is possible for an attacker to create a specially crafted GIF image, which when viewed by a victim will execute arbitrary code as the victim. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the...
USN-149-1: Firefox vulnerabilities
Secunia.com reported that one of the recent security patches in Firefox reintroduced the frame injection patch that was originally known as CAN-2004-0718. This allowed a malicious web site to spoof the contents of other web sites. CAN-2005-1937 In several places the browser user interface did not...
security flaw
Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the search target, then injecting script into other pages via a data: URL...
mfsa2005-49exploit.txt
// Exploit by Kohei Yoshino Sidebar Attack, Reloaded 1. Click here to open this page into sidebar. 2. document.writedocument.cookie;" Click here to steal your cookies on Bugzilla. 3. Then, open about:config in content area. 4. Components.classes'@mozilla.org/...
CVE-2005-2264
Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the search target, then injecting script into other pages via a data: URL...
CVE-2005-2264
Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the search target, then injecting script into other pages via a data: URL...
CVE-2005-2264
Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the search target, then injecting script into other pages via a data: URL...
CVE-2005-2264: Undefined Security Weakness
Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the search target, then injecting script into other pages via a data: URL...
FreeBSD : firefox -- arbitrary code execution from sidebar panel (741f8841-9c6b-11d9-9dbe-000a95bc6fae)
A Mozilla Foundation Security Advisory states : If a user bookmarked a malicious page as a Firefox sidebar panel that page could execute arbitrary programs by opening a privileged page and injecting JavaScript into it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
FreeBSD : firefox -- arbitrary code execution in sidebar panel (1f2fdcff-ae60-11d9-a788-0001020eed82)
A Mozilla Foundation Security Advisory reports : Sites can use the search target to open links in the Firefox sidebar. Two missing security checks allow malicious scripts to first open a privileged page such as about:config and then inject script using a javascript : url. This could be used to...
Script injection from Firefox sidebar panel using data: — Mozilla
Sites can use the search target to open links in the Firefox sidebar. A missing security check allows the sidebar to inject data: urls containing scripts into any page open in the browser. This could be used to steal cookies, passwords or other sensitive data...
mfsa200539.txt
// FrSIRT Comment : If a user clicks on a link, this code will load "about:plugins" // into Firefox sidebar panel and will overwrite "browser.startup.homepage", // which will change the homepage to malicious.com Click Here First Next, Click Here...
CVE-2005-0402
Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page...