CVE-2025-48574: Missing Authorization

In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2025-199368

Malicious code in drop-events-on-property-plugin npm...

Malicious code in drop-events-on-property-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0ea7d31f1e0fec815bf2b3893bc6e320c5c3e309b43d22130d5af8a52a033 The package drop-events-on-property-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191394 Malicious code in drop-events-on-property-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0ea7d31f1e0fec815bf2b3893bc6e320c5c3e309b43d22130d5af8a52a033 The package drop-events-on-property-plugin was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199097

Malicious code in @posthog/drop-events-on-property-plugin npm...

MAL-2025-190946 Malicious code in @posthog/drop-events-on-property-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1dee879dbf8f8819008c31e641e4fec6584690087c6929cba530e9171464cb4 The package @posthog/drop-events-on-property-plugin was found to contain malicious code. Source: ghsa-malware...

EUVD-2012-3641

Malware in sbrugna...

CVE-2012-3694

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...

CVE-2012-3689

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site...

Firefox < 31.0 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities : - When a pair of NSSCertificate structures are added to a trust domain and then one of them is removed during use, a use-after-free error occurs which may...

PT-2014-1475

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 31.0 Description The issue allows remote attackers to alter the placement of UI icons via crafted JavaScript code encountered during page, panel, or toolbar customization. This is due to the improper restricti...

Design/Logic Flaw

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2012-3694

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...

PT-2012-4931

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.0 Description The issue allows user-assisted remote attackers to read arbitrary files via a crafted web site due to improper handling of drag-and-drop events. Recommendations For versions prior to 6.0, update t...

CVE-2012-3689: Improper Input Validation

WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

Code injection

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984: Improper Control of Generation of Code

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...