CVE-2012-4210: Undefined Security Weakness

The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets CSS token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via ...

PT-2012-5253

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 17.0 Mozilla Firefox ESR versions prior to 10.0.11 Description The issue allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet, due to the...

Design/Logic Flaw

The Web Proxy Auto-Discovery WPAD functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data duri...

CVE-2012-4195

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...

CVE-2012-4195: Improper Neutralization of Input During Web Page Generation

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...

Mozilla: Fixes for Location object issues (MFSA 2012-90)

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...

CVE-2012-4195

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...

Design/Logic Flaw

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same...

CVE-2012-4193: Origin Validation Error

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same...

CVE-2012-4193

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same...

CVE-2012-4184: Improper Neutralization of Input During Web Page Generation

The Chrome Object Wrapper COW implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not prevent access to properties of a prototype for a standard class, which allows remote...

CVE-2012-3993: Improper Privilege Management

The Chrome Object Wrapper COW implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to...

PT-2012-5228

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 16.0 Firefox ESR versions prior to 10.0.8 Thunderbird versions prior to 16.0 Thunderbird ESR versions prior to 10.0.8 SeaMonkey versions prior to 2.13 Description The issue allows remote attackers to execute...

PT-2012-5121

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 16.0 Firefox ESR versions prior to 10.0.8 Thunderbird versions prior to 16.0 Thunderbird ESR versions prior to 10.0.8 SeaMonkey versions prior to 2.13 Description The issue is related to the Chrome Object...

PT-2012-5140

Name of the Vulnerable Software and Affected Versions Cybozu KUNAI Browser for Remote Service application beta for Android affected versions not specified Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain sensitive information via a crafted application...

CVE-2012-4012: Exposure of Sensitive Information to an Unauthorized Actor

The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL...

PT-2012-5139

Name of the Vulnerable Software and Affected Versions Cybozu KUNAI application versions prior to 2.0.6 Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain sensitive information via a crafted application. This is achieved by placing the code into a local...

CVE-2012-4009: Improper Control of Generation of Code

The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL...

Mozilla Firefox Multiple Vulnerabilities (Aug 2012) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-3965

Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window...