CVE-2007-2401

The CVE-2007-2401 entry concerns a CRLF injection in Apple’s WebCore XMLHttpRequest handling. Vulnerable: WebCore in Mac OS X 10.3.9, 10.4.9 and later, and iPhone prior to 1.0.1. Nature: remote attacker can inject arbitrary HTTP headers by sending LF characters in an XMLHttpRequest and exploiting...

CVE-2007-2401

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function...

Apple Safari XMLHttpRequest object header injection

It's possible to inject additional headers into XMLHttpRequest object's request...

Apple WebCore XMLHttpRequest fails to properly serialize headers into an HTTP request

Overview Apple WebCore fails to properly serialize headers into an HTTP request, which can cause a cross-domain security violation. Description Apple WebCore is one of the components of the WebKit web browser engine that is used by Safari, Dashboard, Mail, and other applications. WebCore provides...

Apple WebCore - XMLHTTPRequest Cross-Site Scripting

Apple WebCore - XMLHTTPRequest Cross-Site Scripting source: https://www.securityfocus.com/bid/24598/info Apple WebCore is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may exploit this issue by enticing victims in...

Apple WebCore - XMLHTTPRequest Cross-Site Scripting

source: https://www.securityfocus.com/bid/24598/info Apple WebCore is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may exploit this issue by enticing victims into visiting a malicious website. The attacker may...

IE mhtml redirection vulnerability using the method-vulnerability warning-the black bar safety net

This vulnerability is primarily an information leak, see http://secunia. com/advisories/1 9 7 3 8/specific description. In order to ensure client safety, the xmlhttp is not cross-domain access to information. But the IE security problems, in the service end through the mhtml redirection...

CVE-2005-4827

CVE-2005-4827 affects Internet Explorer 6.0 (and possibly other versions). It describes a bypass of the same-origin policy by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) with a method name containing tab, newline, or carriage return characters, a pattern some proxies convert to s...

Design/Logic Flaw

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

CVE-2007-0801

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

CVE-2007-0801

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

DEBIAN-CVE-2007-0801

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

CVE-2007-0801

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

CVE-2007-0801

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

CVE-2007-0801: Undefined Security Weakness

The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest...

CVE-2005-4827: Undefined Security Weakness

Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object Microsoft.XMLHTTP and using tab, newline, and carriage return characters within the...

Mozilla Firefox weak PRNG generator

Weak PRNG generator is used to generate temporary files names for XMLHttpRequest. It may be used to access content of local files by creating temporary HTML file with predictable name...

[Full-disclosure] Web 2.0 backdoors made easy with MSIE & XMLHttpRequest

As you probably know, the famous "web 2.0" XMLHttpRequest object allows client-side web scripts to send nearly arbitrary HTTP requests, and then freely analyze and manipulate the returned response, including HTTP headers. This gives an unprecedented level of control over your browser to the autho...

Taobao password guessing-vulnerability warning-the black bar safety net

| The following is quoted fragment: % 'Test Taobao landing 'Coded '2006-4-17 Response. Buffer = False Dim myUser,myPass myUser = "username" myPass = "password" Response. Write CheckPassmyUser,myPass '-----------------Package to determine the function begin---------------- Function...

CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...