Microsoft Internet Explorer 5.0.1 File Upload Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25836/info Microsoft Internet Explorer is prone to an information-disclosure vulnerability that allows attackers to gain access to the contents of arbitrary files. This issue stems from a design error resulting from the...

CVE-2008-2949: Undefined Security Weakness

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with...

CVE-2002-2311

Microsoft Internet Explorer 6.0 (and possibly others) is affected by CVE-2002-2311. The issue arises when a webpage contains a onkeydown handler that checks event.ctrlKey or event.shiftKey; with those keys pressed, a remote attacker can upload arbitrary file contents. This is the underlying vulne...

CVE-2002-2312: Undefined Security Weakness

Opera 6.0.1 allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript 1 event.ctrlKey or 2 event.shiftKey onkeydown event contained in a webpage...

CVE-2002-2311: Undefined Security Weakness

Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript 1 event.ctrlKey or 2 event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the vendor has disputed the...

security flaw

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated ...

security flaw

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated ...

CVE-2007-5158

The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystrokes via a certain use of a JavaScript htmlFor attribute, as demonstrated by changing focus from a textarea to a file upload field, a related issue to...

CVE-2007-5158: Undefined Security Weakness

The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystrokes via a certain use of a JavaScript htmlFor attribute, as demonstrated by changing focus from a textarea to a file upload field, a related issue to...

Mozilla FireFox OnKeyDown事件文件上传漏洞

Mozilla FireFox是一款流行的开源WEB浏览器。 FireFox在处理文件上传时存在漏洞，恶意网站可能利用此漏洞获取用户系统上的文件。 Firefox没有正确地处理表单字段的焦点，允许攻击者通过OnKeyDown事件将焦点从textarea字段更改至file upload字段，如果用户访问了恶意站点并向textarea输入表单键入了文件名的话，就可能将系统上的任意文件上传到恶意站点。 Mozilla Firefox 2.0.0.4 临时解决方法： 禁用JavaScript 厂商补丁： Mozilla -------...

Microsoft Internet Explorer / Mozilla Firefox user input hijacking

It's possible to hijack input focus by using OnKeyDown / OnKeyPress events...

CVE-2002-1443: Undefined Security Weakness

The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler...