11036 matches found
Cross site scripting
Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header or 2 specifying the content of a Refresh header. NOTE...
CVE-2009-1307
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...
Design/Logic Flaw
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...
CVE-2009-1307
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...
CVE-2009-1307
CVE-2009-1307 is evidenced in connected documents as a vulnerability in the view-source: URI handling in Mozilla Firefox before 3.0.9 (also affecting Thunderbird and SeaMonkey) that breaks the Same Origin Policy. It enables remote attackers to bypass cross-domain restrictions and connect to arbit...
Firefox Malicious search plugins can inject code into arbitrary sites
Cross-site scripting XSS vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element...
Firefox < 3.0.9 Multiple Vulnerabilities
The installed version of Firefox is earlier than 3.0.9. Such versions are potentially affected by the following security issues : - Multiple remote memory corruption vulnerabilities exist that can be exploited to execute arbitrary code in the context of the user running the affected application...
view-source: protocol
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...
jar: scheme ignores the content-disposition: header on the inner URI
The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly other attacks via an uploaded .jar file with a...
CVE-2008-6742
Foxy P2P software allows remote attackers to cause a denial of service memory consumption via a foxy URI with a download action and a large fs value...
CVE-2009-1353
Buffer overflow in the httpparsehex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service daemon crash via a long URI, related to http.c...
CVE-2009-1351
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long URI in a playlist .m3u file...
Directory traversal
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the URI...
Heap overflow
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long URI in a playlist .m3u file...
Buffer overflow
Buffer overflow in the httpparsehex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service daemon crash via a long URI, related to http.c...
CVE-2009-1354
CVE-2009-1354 describes a directory traversal vulnerability in Mongoose 2.4, where remote attackers can read arbitrary files through a .. in the URI. The NVD entry records a CVSSv2 base score of 4.0 (Medium) with network attack vector and low attack complexity; impact is partial confidentiality. ...
CVE-2009-1351
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long URI in a playlist .m3u file...
CVE-2009-1354
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. dot dot in the URI...