Firefox Malicious search plugins can inject code into arbitrary sites

Cross-site scripting XSS vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element...

Firefox < 3.0.9 Multiple Vulnerabilities

The installed version of Firefox is earlier than 3.0.9. Such versions are potentially affected by the following security issues : - Multiple remote memory corruption vulnerabilities exist that can be exploited to execute arbitrary code in the context of the user running the affected application...

view-source: protocol

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...

jar: scheme ignores the content-disposition: header on the inner URI

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly other attacks via an uploaded .jar file with a...

CVE-2008-6742

Foxy P2P software allows remote attackers to cause a denial of service memory consumption via a foxy URI with a download action and a large fs value...

CVE-2009-1353

Buffer overflow in the httpparsehex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service daemon crash via a long URI, related to http.c...

CVE-2009-1351

Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long URI in a playlist .m3u file...

Buffer overflow

Buffer overflow in the httpparsehex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service daemon crash via a long URI, related to http.c...

Directory traversal

Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

Heap overflow

Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long URI in a playlist .m3u file...

CVE-2009-1351

Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long URI in a playlist .m3u file...

CVE-2009-1354

CVE-2009-1354 describes a directory traversal vulnerability in Mongoose 2.4, where remote attackers can read arbitrary files through a .. in the URI. The NVD entry records a CVSSv2 base score of 4.0 (Medium) with network attack vector and low attack complexity; impact is partial confidentiality. ...

CVE-2009-1354

Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2009-1353

Buffer overflow in the httpparsehex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service daemon crash via a long URI, related to http.c...

Cross site scripting

Cross-site scripting XSS vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2009-1349

Cross-site scripting XSS vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI...

Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString — Mozilla

Mozilla security researcher mozbugra4 reported that it is possible to create a document whose URI does not match the document's principal using XMLHttpRequest. This type of mismatch leads to incorrect results in principal-based security checks. An attacker could use this vulnerability to execute...

Malicious search plugins can inject code into arbitrary sites — Mozilla

Security researcher Prateek Saxena reported that a malicious MozSearch plugin could be created using a javascript: URI in the SearchForm value. This URI is used as the default landing page when an empty search is performed. If an attacker could get a user to install the malicious plugin and perfo...

Firefox allows Refresh header to redirect to javascript: URIs — Mozilla

Mozilla community member Michael reported that when a server responds with a Refresh header containing a javascript: URI, Firefox will redirect to the javascript: URI. If an attacker could inject a Refresh header into a server response, or could control the value that a site places in the Refresh...

CVE-2009-0038

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...