CVE-2025-48574: Missing Authorization

In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2012-3641

Malware in sbrugna...

CVE-2012-3694

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...

CVE-2012-3689

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site...

Firefox < 31.0 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities : - When a pair of NSSCertificate structures are added to a trust domain and then one of them is removed during use, a use-after-free error occurs which may...

PT-2014-1475

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 31.0 Description The issue allows remote attackers to alter the placement of UI icons via crafted JavaScript code encountered during page, panel, or toolbar customization. This is due to the improper restricti...

Design/Logic Flaw

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2012-3694

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...

PT-2012-4931

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.0 Description The issue allows user-assisted remote attackers to read arbitrary files via a crafted web site due to improper handling of drag-and-drop events. Recommendations For versions prior to 6.0, update t...

CVE-2012-3689: Improper Input Validation

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site...