JVN#30221194: Sage vulnerable to arbitrary script execution

Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's Mozilla...

Code injection

IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service daemon crash by subscribing to an Atom feed, aka SPR JRIE7VKMP9...

CVE-2009-5062

IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service daemon crash by subscribing to an Atom feed, aka SPR JRIE7VKMP9...

CVE-2009-5062

CVE-2009-5062 affects IBM Lotus Quickr 8.1 before 8.1.0.15 on AIX running Lotus Domino services. A remote authenticated user can cause a daemon crash (denial of service) by subscribing to an Atom feed, identified as SPR JRIE7VKMP9. According to the provided data, the CVSSv2 score is 3.5 (Network ...

CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

Code injection

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

UBUNTU-CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

Google Chrome RSS Or Atom Feed Cross-Site Scripting Vulnerability

This host is installed with Google Chrome and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: secpodgooglechromerssnatomxssvuln.nasl 5055 2017-01-20 14:08:39Z teissa $ Google Chrome RSS Or Atom Feed Cross-Site Scripting Vulnerability Authors: Sharath S Copyright:...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3266

Opera before 10.01 is vulnerable to cross-site scripting via crafted RSS/Atom feeds due to improper HTML restriction when processing application/rss+xml as scripted content. This can enable remote XSS and cross-zone scripting on the Feed Subscription Page to read feeds or create subscriptions. Af...

CVE-2009-3265

Opera 9.x/10.x is affected by CVE-2009-3265, a Cross-site scripting (XSS) flaw where rendering of RSS/Atom feeds as scripted content enables injection of arbitrary script/HTML. The underlying issue is the handling of application/rss+xml as scripted content. The vendor reportedly viewed this as a ...

CVE-2009-3263

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

ibmatom-xss.txt

XSS using Atom feed in www.ibm.com Abstract: A XSS using Atom feed was in www.ibm.com already fixed. This XSS technique appears only by IE6, not appears on IE7 and Firefox. Poc: http://www.ibm.com/fscripts/search/opensearch/search.fcgi/a.html?...

FeedDemon < 2.0.0.25 Atom Feed Active Script Code Execution

According to the Windows registry, the version of FeedDemon, an RSS reader for Windows, installed on the remote host is affected by a flaw due to improper sanitization of RSS feeds of Active Script code. An attacker can exploit this issue to inject arbitrary script into the affected application,...

RSSOwl < 1.2.3 Atom Feed XSS

Binary data 3746.prm...

CVE-2006-4760

Multiple cross-site scripting XSS vulnerabilities in Benjamin Pasero and Tobias Eichert RSSOwl allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...

CVE-2006-4761

Multiple cross-site scripting XSS vulnerabilities in Luke Hutteman SharpReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...

CVE-2006-4710

Multiple cross-site scripting XSS vulnerabilities in NewsGator FeedDemon before 2.0.0.25 allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite...

CVE-2006-4710

Multiple cross-site scripting XSS vulnerabilities in NewsGator FeedDemon before 2.0.0.25 allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite...

DEBIAN-CVE-2005-2110

WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via 1 a direct request to menu-header.php or a "1" value in the feed parameter to 2 wp-atom.php, 3 wp-rss.php, or 4 wp-rss2.php, which reveal the path in an error message. NOTE: vector 1 was later reported to al...