1482 matches found
Mozilla Thunderbird < 13.0 Multiple Vulnerabilities
The installed version of Thunderbird is earlier than 13.0 and thus, is potentially affected by the following security issues : - An error exists in the ASN.1 decoder when handling zero length items that can lead to application crashes. CVE-2012-0441 - Multiple memory corruption errors exist...
Firefox 10.0.x < 10.0.5 Multiple Vulnerabilities
The installed version of Firefox 10.0.x is potentially affected by the following security issues : - An error exists in the ASN.1 decoder when handling zero length items that can lead to application crashes. CVE-2012-0441 - Multiple memory corruption errors exist. CVE-2012-1937, CVE-2012-1939 - T...
Cross site scripting
The Content Security Policy CSP implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not block inline event handlers, which makes it easier for remote attackers to condu...
Ubuntu: Security Advisory (USN-1400-5)
The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Crlf injection
CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy CSP restrictions and possibly conduct...
CVE-2012-0451
CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy CSP restrictions and possibly conduct...
CVE-2011-2990
The implementation of Content Security Policy CSP violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by...
CVE-2011-2990
The CVE-2011-2990 vulnerability affects Mozilla Firefox 4.x–5 and SeaMonkey 2.x (before 2.3) where Content Security Policy (CSP) violation reports do not strip proxy-authorization credentials from the request headers, enabling potential leakage of credentials when a CSP report is read. The issue ...
CVE-2011-2990
The implementation of Content Security Policy CSP violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by...
Security issues addressed in SeaMonkey 2.3 — Mozilla
Miscellaneous memory safety hazards rv:4.0 Impact: Critical Description: Mozilla identified and fixed several memory safety bugs in the browser engine used in SeaMonkey 2.2 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and w...
Mozilla Releases Preview Builds of Firefox with Content Security Policy
Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks. The CSP specification is Mozilla’s effort to provide Web site operators with a simpler way to...
CVE-2007-4427
InterSystems Cache CSP login-page redirection logic (Cache’ 2007.1.0.369.0 and 2007.1.1.420.0) contains an unspecified vulnerability in parameter value encoding that lets remote authenticated users modify server data. Root cause: encoding of certain parameters in the redirection logic. Impact: da...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the sample Cache' Server Page CSP scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via 1 the TO parameter to loop.csp, 2 the VALUE parameter to cookie.csp, and 3 the PAGE parameter to showsource.csp i...
CVE-2007-0437
Multiple cross-site scripting XSS vulnerabilities in the sample Cache' Server Page CSP scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via 1 the TO parameter to loop.csp, 2 the VALUE parameter to cookie.csp, and 3 the PAGE parameter to showsource.csp i...
CVE-2007-0437
CVE-2007-0437 involves multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts of InterSystems Cache. The affected components are CSP samples under csp/samples/: loop.csp (TO parameter), cookie.csp (VALUE), showsource.csp (PAGE); and (4) xmlclasseserror....
CVE-2006-2930
Unspecified vulnerability in Sun Grid Engine 5.3 and Sun N1 Grid Engine 6.0, when configured in Certificate Security Protocol CSP Mode, allows local users to shut down the grid service or gain access, even if access is denied...
[SA20518] Sun Grid Engine CSP Mode Authentication Security Issue
---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...
Cryptomathic ActiveX Buffer Overflow (TDC Digital signature)
A vulnerability has been found in an ActiveX object distributed as part of TDC' Microsoft CSP suite. The suite consists of Cryptomathic PrimeInk CSP and some ActiveX objects. The primary task of the CSP is to handle private RSA keys that are encrypted by keys derived from the user provided...
CVE-2002-0940
domesticinstall.exe for nCipher MSCAPI CSP 5.50 and 5.54 does not use Operator Card Set protected keys when the user requests them but does not generate the Operator Card Set, which results in a lower protection level than specified by the user module protection only...
CVE-2002-0940
This CVE concerns domesticinstall.exe for nCipher MSCAPI CSP 5.50 and 5.54, where the software does not use Operator Card Set protected keys when the user requests them if the Operator Card Set has not been generated. The outcome is a lower protection level than the user-specified module protecti...