CVE-2007-2408

The CVE-2007-2408 issue affects WebKit/Safari: WebKit in Apple Safari 3 Beta (before Update 3.0.3) does not properly honor an unchecked Enable Java setting, allowing remote attackers to execute Java applets via a crafted page. Vulnerability lies in how the Java preference is processed, enabling p...

security flaw

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via 1 HTTP 302 redirect controls, 2...

JVN#95249468 Fresh Reader RSS feed cross-site scripting vulnerability

Impact An arbitrary script could be executed on the web browser of a Fresh Reader user. Solution Products Affected Fresh Reader Ver 1.0.06053100 and earlier For more information, refer to the vendor's website...

Internet Explorer Undisclosed Script Handler Buffer Overflow (MS06-072; CVE-2006-5579)

Microsoft Internet Explorer IE contains a remote code execution vulnerability. By convincing a user to visit a specially crafted Web page, a remote attacker may trigger this vulnerability to deny service from legitimate users by causing the victim's Web browser to crash or execute arbitrary code ...

BlueSocket BSC 2100 5.0/5.1 - Admin.pl Cross-Site Scripting

source: https://www.securityfocus.com/bid/21419/info BlueSocket BSC 2100 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in...

[SA22048] Apple QuickTime Plug-In Local Resource Linking Weakness

TITLE: Apple QuickTime Plug-In Local Resource Linking Weakness SECUNIA ADVISORY ID: SA22048 VERIFY ADVISORY: http://secunia.com/advisories/22048/ CRITICAL: Not critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: Apple QuickTime 7.x http://secunia.com/product/5090/ DESCRIPTION: pdp has...

CVE-2006-4092

Simpliciti Locked Browser does not properly limit a user's actions to ones within the intended Internet Explorer environment, which allows local users to perform unauthorized actions by visiting a web site that executes a JavaScript window.blur loop to remove focus from the browser window, then...

vulnerabilities: CVE-2006-{3113,3677,3801-3812}

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and possibly load chrome: URLs by tricking the user into copying or dragging links...

msie-heap.txt

// MoBB Demonstration function Demo var a = new ActiveXObject"Internet.HHCtrl.1"; var b = unescape"XXXX"; while b.length Clicking the button below may crash your browser!...

Chipmunk 1.4 - 'Guestbook index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18118/info Chipmunk Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

IntelliLink Pro 5.06 - 'addlink_lwp.cgi?url' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17605/info IntelliLink Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execut...

security flaw

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by...

security flaw

Firefox before 1.0 and Mozilla before 1.7.5 allows inactive background tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."...

security flaw

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolli...

Java Web Start argument injection vulnerability

OVERVIEW ======== Java Web Start is a technology for easy client-side deployment of Java applications. "Using Java Web Start technology, standalone Java software applications can be deployed with a single click over the network" from Sun Microsystems's website. Java Web Start is installed with Ja...

security flaw

The International Domain Name IDN support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which...

SSL "secure site" indicator spoofing — Mozilla

Various schemes were reported that could cause the "secure site" lock icon to appear and show certificate details for the wrong site. These could be used by phishers to make their spoofs look more legitimate, particularly in windows that hide the address bar showing the true location...

MercuryBoard Forum 1.01.1 - Cross-Site Scripting

MercuryBoard Forum 1.01.1 - Cross-Site Scripting source: https://www.securityfocus.com/bid/12578/info A remote cross-site scripting vulnerability affects the 'forum.php' script of MercuryBoard. This issue is due to a failure of the application to properly sanitize user-supplied input prior to...

Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation

Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation source: https://www.securityfocus.com/bid/12541/info Microsoft Internet Explorer is reported prone to a URI obfuscation weakness. The issue presents itself when a HREF tag contains certain mouse events. This issue may be...

Browser responds to proxy auth request from non-proxy server (ssl/https) — Mozilla

If a proxy is configured the browser would respond to a 407 proxy auth request from any SSL-connected server rather than only responding to the configured proxy server. This could leak NTLM or SPNEGO credentials outside the organization...