43 matches found
SUSE CVE-2015-4483
Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request...
CVE-2023-24060
Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...
CVE-2015-4483
Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request...
CVE-2015-4483
Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request...
CVE-2015-4483
CVE-2015-4483 affects Mozilla Firefox up to version 40.0. A vulnerability in the feed: protocol combined with POST requests can bypass the browser’s mixed-content protections, enabling MITM-scripted content on a page. Remediation: upgrade to the latest Firefox (40.0+).
Design/Logic Flaw
RT aka Request Tracker before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL...
CVE-2012-0678
Cross-site scripting XSS vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL...
Code injection
Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL...
Cross site scripting
Cross-site scripting XSS vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL...
CVE-2012-0678
Cross-site scripting XSS vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL...
CVE-2012-0679
The CVE-2012-0679 issue affects Apple Safari prior to version 6.0, where a feed:// URL can be used to read arbitrary local files. This is documented in the NVD entry and corroborated by Red Hat and other vendors' advisories referencing Safari
CVE-2012-0679
Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL...
CVE-2012-0678
CVE-2012-0678 is an XSS vulnerability in Apple Safari prior to 6.0 that can be triggered via feed:// URLs. Affected product: Safari on macOS; root cause is improper handling of feed:// links leading to script/HTML injection. Confirmed by Red Hat and OpenVAS entries referencing Safari
Mozilla: feed: URLs with an innerURI inherit security context of page (MFSA 2012-55)
Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...
CVE-2010-3796
Safari RSS in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not block Java applets in an RSS feed, which allows remote attackers to obtain sensitive information via a feed: URL containing an applet that performs DOM modifications...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 rssfeedURL parameter to manual/caferss/example.php and the sumb parameter to 2 modules/news/archive.php, 3 modules/news/topics.php, and 4...
CVE-2009-0162
Cross-site scripting XSS vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL...
Input validation
Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues."...
opera -- multiple vulnerabilities
Opera reports: Certain constructs are not escaped correctly by Opera's History Search results. These can be used to inject scripts into the page, which can then be used to look through the user's browsing history, including the contents of the pages they have visited. These may contain sensitive...