2796 matches found
Mozilla arbitrary code execution
Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to steal navigation history and cause a denial of service crash via images in a page that uses designMode frames, which triggers memory corruption related to resize handles...
Mozilla URL token stealing flaw
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original UR...
Mozilla URL token stealing flaw
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original UR...
Mozilla arbitrary code execution
Multiple cross-site scripting XSS vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including 1 a backspace character that is treated as...
URL token stealing via stylesheet redirect — Mozilla
Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects much as the document.location property is updated. This differs from other browsers and could...
Apple QuickTime RTSP Response message Reason-Phrase buffer overflow vulnerability
Overview Apple QuickTime contains a buffer overflow vulnerability that may allow a remote, unauthenticated attacker to cause a denial-of-service condition and possibly execute arbitrary code. Description Real Time Streaming Protocol RTSP is a protocol that is used by streaming media systems. Appl...
MS Windows Media Player 9 Plugin Overflow Exploit (MS06-006) (meta)
No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same...
MS Windows Media Player 10 Plugin Overflow Exploit (MS06-006)
No description provided by source. HTML HEAD TITLEWMP Plugin EMBED Exploit/TITLE SCRIPT // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for...
Apache Httpd < 2.2.8 : mod_proxy_ftp UTF-7 XSS
A workaround was added in the modproxyftp module. On sites where modproxyftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616...
Apple Safari 1.x3.0.x Firefox 1.5.0.x2.0.x - JavaScript Multiple Fields Key Filterings
Apple Safari 1.x3.0.x Firefox 1.5.0.x2.0.x - JavaScript Multiple Fields Key Filterings source: https://www.securityfocus.com/bid/26669/info Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users. Exploiti...
Directory Traversal in SafeNet Sentinel Protection Server and Keys Server
SUMMARY ======= SafeNet Inc.'s Sentinel Protection Server and Sentinel Keys Server products include web servers which are vulnerable to directory traversal attacks. A remote attacker could exploit these vulnerabilities to read arbitrary files with the permissions of the web server, typically...
JVN#65427327 Sleipnir and Grani Bookmark Search vulnerable to arbitrary script execution
Sleipnir and Grani, web browsers from Fenrir & Co., have a bookmark search function. When a user runs the search function, the search result is displayed in the web browser. If a specially crafted URL is registered to the bookmark, an attacker could execute an arbitrary script on the user's web...
Mozilla-based browsers jar: URI cross-site scripting vulnerability
Overview Mozilla-based web browsers including Firefox contain a vulnerability that may allow an attacker to execute code, or conduct cross-site scripting attacks. Description The jar: protocol is designed to extract content from ZIP compressed files. Mozilla-based browsers include support for jar...
CVE-2002-2330
Cross-site scripting XSS vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via 1 HTTPUSERAGENT or 2 HTTPREFERER, which is written to stats.html and executed in client browsers...
Important: Red Hat Security Advisory: java-1.5.0-sun security update
Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. The Java Runtime Environment JRE contains the...
CVE-2007-4465
Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...
Apple Quicktime (Multiple Browsers) Command Execution PoC (0day)
Exploit for multiple platform in category remote exploits ================================================================ Apple Quicktime Multiple Browsers Command Execution PoC 0day ================================================================ 0day.today 2018-01-06...
Apple QuickTime (Multiple Browsers) - Command Execution
Apple QuickTime Multiple Browsers - Command Execution milw0rm.com 2007-09-12...
