JVN#99203127: Sage vulnerable to arbitrary script execution

Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's Mozilla...

CVE-2009-5062

IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service daemon crash by subscribing to an Atom feed, aka SPR JRIE7VKMP9...

Code injection

IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service daemon crash by subscribing to an Atom feed, aka SPR JRIE7VKMP9...

CVE-2009-5062

CVE-2009-5062 affects IBM Lotus Quickr 8.1 before 8.1.0.15 on AIX running Lotus Domino services. A remote authenticated user can cause a daemon crash (denial of service) by subscribing to an Atom feed, identified as SPR JRIE7VKMP9. According to the provided data, the CVSSv2 score is 3.5 (Network ...

PT-2011-1323

Name of the Vulnerable Software and Affected Versions IBM Lotus Quickr 8.1 versions prior to 8.1.0.15 Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash, by subscribing to an Atom feed. Recommendations For versions prior to 8.1.0.15,...

CVE-2009-5062: Undefined Security Weakness

IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service daemon crash by subscribing to an Atom feed, aka SPR JRIE7VKMP9...

Code injection

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

UBUNTU-CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

CVE-2010-0044: Undefined Security Weakness

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

Google Chrome RSS Or Atom Feed Cross-Site Scripting Vulnerability

This host is installed with Google Chrome and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: secpodgooglechromerssnatomxssvuln.nasl 5055 2017-01-20 14:08:39Z teissa $ Google Chrome RSS Or Atom Feed Cross-Site Scripting Vulnerability Authors: Sharath S Copyright:...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3263

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3266

Opera before 10.01 is vulnerable to cross-site scripting via crafted RSS/Atom feeds due to improper HTML restriction when processing application/rss+xml as scripted content. This can enable remote XSS and cross-zone scripting on the Feed Subscription Page to read feeds or create subscriptions. Af...

CVE-2009-3265

Opera 9.x/10.x is affected by CVE-2009-3265, a Cross-site scripting (XSS) flaw where rendering of RSS/Atom feeds as scripted content enables injection of arbitrary script/HTML. The underlying issue is the handling of application/rss+xml as scripted content. The vendor reportedly viewed this as a ...

CVE-2009-3265: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design...

CVE-2009-3263: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3266: Improper Neutralization of Input During Web Page Generation

Opera before 10.01 does not properly restrict HTML in a 1 RSS or 2 Atom feed, which allows remote attackers to conduct cross-site scripting XSS attacks, and conduct cross-zone scripting attacks involving the Feed Subscription Page to read feeds or create feed subscriptions, via a crafted feed,...

ibmatom-xss.txt

XSS using Atom feed in www.ibm.com Abstract: A XSS using Atom feed was in www.ibm.com already fixed. This XSS technique appears only by IE6, not appears on IE7 and Firefox. Poc: http://www.ibm.com/fscripts/search/opensearch/search.fcgi/a.html?...