[security bulletin] HPSBGN02694 SSRT100586 rev.1 - HP webOS Contacts Application, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02937744 Version: 1 HPSBGN02694 SSRT100586 rev.1 - HP webOS Contacts Application, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon...

CVE-2011-2409

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2408

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2409

The CVE-2011-2409 issue affects HP webOS Calendar on HP Palm webOS 3.x prior to 3.0.2. The vulnerability is a Cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Reported impact indicates potential for arbitrary HTML/JavaScr...

CVE-2011-2408

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2408

CVE-2011-2408 affects HP webOS 3.x, specifically the Contacts application, where an XSS vulnerability exists in the Contacts UI before version 3.0.2. The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. HP security bulletin HPSBGN02694 rev.1 notes affec...

CVE-2011-2409

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2011-3837

Name of the Vulnerable Software and Affected Versions HP Palm webOS versions prior to 3.0.2 Description A cross-site scripting XSS issue exists in the Calendar application, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For HP Palm webOS...

CVE-2011-2408: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2011-3836

Name of the Vulnerable Software and Affected Versions HP Palm webOS versions prior to 3.0.2 Description A cross-site scripting XSS issue exists in the Contacts application, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior...

CVE-2011-1738

HP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit PDK applications, which allows local users to gain privileges by leveraging unintended filesystem write access...

CVE-2011-1737

Multiple cross-site scripting XSS vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

HP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit PDK applications, which allows local users to gain privileges by leveraging unintended filesystem write access...

CVE-2011-1738

HP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit PDK applications, which allows local users to gain privileges by leveraging unintended filesystem write access...

CVE-2011-1737

Multiple cross-site scripting XSS vulnerabilities in the Email application in HP Palm webOS 1.4.5 and 1.4.5.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-1738

HP Palm webOS 1.4.5 and 1.4.5.1 are affected by CVE-2011-1738 due to improper restriction of Plug-in Development Kit (PDK) applications, enabling local privilege escalation via unintended filesystem write access. The root cause is insufficient access controls on PDK apps, allowing local users to ...