Maxthon 'javascript:' And 'data:' URI XSS Vulnerability

This host is installed with Maxthon Browser and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: gbmaxthonjavascriptndataurixssvuln.nasl 4869 2016-12-29 11:01:45Z teissa $ Maxthon 'javascript:' And 'data:' URI XSS Vulnerability Authors: Sharath S Copyright: Copyrigh...

Google Chrome 'javascript: URI' XSS Vulnerability (Sep 2009)

Google Chrome Web Browser is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple Safari 'javascript: URI' XSS Vulnerability (Sep 2009)

Apple Safari Web Browser is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2009-3017

Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, ...

CVE-2009-3010

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting ...

CVE-2009-3015

QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains a javascript: URI, 2...

Cross site scripting

Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains a javascript: URI, 2...

CVE-2009-3015

QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains a javascript: URI, 2...

CVE-2009-3012

The CVE-2009-3012 entry affects Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre. The vulnerability arises because Firefox does not properly block data: URIs in Location headers in HTTP responses, enabling remote XSS via two vectors: (1) a Location header containing a data:text...

CVE-2009-3018

Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains a javascript: URI, 2...

CVE-2009-3010

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting ...

CVE-2009-3000

The sockfs module in the kernel in Sun Solaris 10 and OpenSolaris snv41 through snv122, when Network Cache Accelerator NCA logging is enabled, allows remote attackers to cause a denial of service panic via unspecified web-server traffic that triggers a NULL pointer dereference in the nl7chttplog...

RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:1126)

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a...

Squid Proxy Invalid HTTP Response Status Code Denial of Service (CVE-2009-2621)

The Squid proxy server is a popular open source, Internet proxy and web caching application. A denial of service vulnerability has been reported in Squid proxy. The vulnerability is due to an error within the Squid proxy that fails to properly handle malformed HTTP responses. A remote attacker ca...

http-userdir-enum NSE Script

Attempts to enumerate valid usernames on web servers running with the moduserdir module or similar enabled. The Apache moduserdir module allows user-specific directories to be accessed using the syntax. This script makes http requests in order to discover valid user-specific directories and infer...

Stack overflow

Stack-based buffer overflow in the SaveAs feature SaveFileAsWithFilter function in winutil.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long...

CVE-2008-6994

Stack-based buffer overflow in the SaveAs feature SaveFileAsWithFilter function in winutil.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long...

CVE-2008-6994

Removed by vendor...

Moderate: Red Hat Security Advisory: httpd security and bug fix update

Updated httpd packages that fix multiple security issues and a bug are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. The httpd package shipped with...

CVE-2009-2582

Stack-based buffer overflow in manager.exe in Akamai Download Manager aka DLM or dlmanager before 2.2.4.8 allows remote web servers to execute arbitrary code via a malformed HTTP response during a Redswoosh download, a different vulnerability than CVE-2007-1891 and CVE-2007-1892...