CVE-2006-0070

Drupal allows remote attackers to conduct cross-site scripting XSS attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtere...

security flaw

Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of service application crash via JavaScript that repeatedly calls an empty function...

US Robotics Broadband Router 8003 menu.htm Admin Password Disclosure

The remote host appears to be a US Robotics Broadband router. The device's administrator password is stored as plaintext in a JavaScript function in the file '/menu.htm', which can be viewed by anyone. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: Tue, 8 Jun 2004 13:41:11 +0200...

CVE-2003-1419

Netscape 7.0 allows remote attackers to cause a denial of service crash via a web page with an invalid regular expression argument to the JavaScript reformatDate function...

CVE-2003-0791

The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed...

CVE-2002-0706

CVE-2002-0706 affects SurfControl SuperScout WebFilter’s Web Reports Server, specifically the UserManager.js component. The root cause is the use of weak encryption for administrator functions, with a hard-coded key inside a JavaScript function, enabling decryption of the admin password. This all...

CVE-2001-1539

Stack consumption vulnerability in Internet Explorer The JavaScript settimeout function in Internet Explorer allows remote attackers to cause a denial of service crash via the JavaScript settimeout function. NOTE: the vendor could not reproduce the problem...