SUSE-SA:2006:053: flash-player

The remote host is missing the patch for the advisory SUSE-SA:2006:053 flash-player. Multiple input validation errors have been identified in the Macromedia Flash Player that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered...

SUSE-SA:2006:061: opera

The remote host is missing the patch for the advisory SUSE-SA:2006:061 opera. The web browser Opera has been updated to fix 2 security problems. CVE-2006-4339: Opera was affected by the RSA signature checking problem found in openssl, since it is statically linked against openssl. CVE-2006-4819: ...

JVN#84746611 Ariel AirOne series cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. Solution Products Affected Ariel AirOne ProjectA v4.6.1 Ariel MultiScheduler v4.6.3 For more information, refer to the vendor's website...

LizardTech DjVu Browser Plug-in buffer overflow vulnerabilities

Overview The LizardTech DjVu Browser Plug-in contains multiple buffer overflows, which could allow an attacker to execute arbitrary code on a vulnerable system. Description The LizardTech DjVu Browser Plug-in is an application that allows the user to view DjVu documents in a web browser. It is...

Internet Explorer for Windows Mobile远程WML内容拒绝服务漏洞

Internet Explorer for Windows Mobile是为移动设备所设计的WEB浏览器。 IE for Windows Mobile在处理畸形WML文件时存在漏洞，远程攻击者可能利用此漏洞对移动设备执行拒绝服务攻击。 如果用户使用IE for Windows Mobile浏览了包含有畸形内容的WML页面的话，就会在浏览器中触发溢出，导致拒绝服务，受影响设备的用户必须执行断电重置才能恢复正常操作。 Microsoft Internet Explorer for Windows Mobile 5.0...

JVN#28356427 ColdFusion cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct a session hijacking. Solution Products Affected ColdFusion MX 7.X For more information, refer to the vendor's website...

Mozilla Firefox JavaScript窃取键盘动作漏洞

Mozilla Firefox是一款流行的开源WEB浏览器。 Firefox在处理用户文件上传时存在漏洞，远程恶意网站可能利用此漏洞非授权获取用户机器上的文件。 在所有现代的浏览器中用于向远程服务器上传用户指定文件的INPUT TYPE=FILE表单字段都受到了额外的保护，以防止脚本随意的选择将要发送的文件，或未经用户确认自动提交表单。例如，无法设置或更改.value参数，任何对.type的更改都会重置字段的内容。 但Firefox允许恶意脚本将精心选择的用户键盘动作重新定向到隐藏的文件上传字段，以构建特殊的文件名，然后提交表单。...

ELinks: Arbitrary Samba command execution

Background ELinks is a text mode web browser. Description Teemu Salmela discovered an error in the validation code of "smb://" URLs used by ELinks, the same issue as reported in GLSA 200612-16 concerning Links. Impact A remote attacker could entice a user to browse to a specially crafted "smb://"...

JVN#80271113 MODx cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected MODx 0.9.2.x and earlier...

JVN#05123538 CGI RESCUE WebFORM vulnerable to cross-site scripting

Impact An abitrary script may be executed on the user's web browser. Solution Products Affected WebFORM 4.3 and earlier According to the vendor's website, another product Web Mailer also contains a similar vulnerability. We have confirmed that the fixed version of the Web Mailer is also released...

Oracle Reports Web Cartridge (RWCGI60)跨站脚本执行漏洞

Oracle应用服务器是一个综合解决方案，用于开发、集成和部署企业的应用系统、门户和网站。 Oracle应用服务Reports Web Cartridge在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在用户浏览器中执行恶意脚本代码。 在使用Oracle应用服务器处理Web客户端请求时，报表服务器必需Reports Web CGI或Web Cartridge。由于没有正确验证genuser参数，远程攻击者可以在输入中注入任意脚本并在客户端浏览器中执行。这一漏洞在认证表单中尤其严重，因为恶意用户可以通过这种攻击获得其他用户的认证凭据。 Oracle Application...

US-CERT Technical Cyber Security Alert TA07-022A

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-022A Sun Updates for Multiple Vulnerabilities in Java Original release date: January 22, 2007 Last revised: -- Source: US-CERT Systems Affected Sun Java Runtime Environment versions JDK a...

Adobe Acrobat allows pointer overwrite via specially crafted PDF file

Overview Adobe Acrobat and Adobe Reader fail to properly handle a specially crafted PDF file, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Adobe Acrobat and Adobe Reader are applications designed to create and view Portable Document Format PDF...

JVN#95249468 Fresh Reader RSS feed cross-site scripting vulnerability

Impact An arbitrary script could be executed on the web browser of a Fresh Reader user. Solution Products Affected Fresh Reader Ver 1.0.06053100 and earlier For more information, refer to the vendor's website...

Fedora Core 5 : firefox-1.5.0.9-1.fc5 (2006-1499)

Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running...

Fedora Core 5 : firefox-1.5.0.7-1.fc5 (2006-976)

Mozilla Firefox is an open source Web browser. Two flaws were found in the way Firefox processed certain regular expressions. A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox. CVE-2006-4565, CVE-2006-4566 A number of flaws were found in...

Fedora Core 5 : mozilla-1.7.13-1.1.fc5 (2006-487)

Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bugs...

Fedora Core 4 : mozilla-1.7.13-1.1.fc4 (2006-488)

Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bugs...

Fedora Core 6 : devhelp-0.12-9.fc6 / epiphany-2.16.2-1.fc6 / firefox-1.5.0.9-1.fc6 / etc (2006-1492)

Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running...

[SECURITY] Fedora Core 5 Update: w3m-0.5.1-15.fc5

The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML document, you can follow links and view images using an external image viewer; its internet message mode determines the type of document from t...