datatransfer-client (2.13.0), parsons (>=0.7.0, <=0.11.1) +1 more potentially affected by CVE-2020-29128 via petl (1.2.0)

petl PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on petl and may be impacted: - datatransfer-client 2.13.0 - parsons =0.7.0, =0.4.0, =0.10.1 Source cves: CVE-2020-29128 Source advisory: OSV:PYSEC-2020-75...

datatransfer-client (2.13.0), parsons (>=0.7.0, <=0.11.1) +1 more potentially affected by CVE-2020-29128 via petl (1.2.0)

petl PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on petl and may be impacted: - datatransfer-client 2.13.0 - parsons =0.7.0, =0.4.0, =0.10.1 Source cves: CVE-2020-29128 Source advisory: MEND:CVE-2020-29128...

Code injection

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...

CVE-2016-5266: Undefined Security Weakness

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...

OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competiti...

OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)

The Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competiti...