CVE-2011-3999

CVE-2011-3999 affects the Iwate Portal Bar RSS/Atom feed reader component. The vulnerability arises from improper HTML output processing based on feed information, enabling cross-site scripting (XSS) that can lead to arbitrary script execution in Internet Explorer when viewing crafted feeds. Publ...

PT-2011-4811

Name of the Vulnerable Software and Affected Versions Iwate Portal Bar affected versions not specified Description A cross-site scripting XSS issue exists in the RSS/Atom feed-reader implementation, allowing remote attackers to inject arbitrary web script or HTML via a crafted feed. Recommendatio...

CVE-2011-3999: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the RSS/Atom feed-reader implementation in Iwate Portal Bar allows remote attackers to inject arbitrary web script or HTML via a crafted feed...

Moderate: Red Hat Security Advisory: thunderbird security update

An updated thunderbird package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Iwate Portal Bar vulnerable to arbitrary script execution

Overview Iwate Portal Bar is vulnerable to arbitrary script execution. Iwate Portal Bar is an add-on to Internet Explorer that adds a toolbar and provides multiple functions. The RSS/Atom feed reader function in Iwate Portal Bar is vulnerable to arbitrary script execution due to the improper...

Debian DSA-2334-1 : mahara - several vulnerabilities

Several vulnerabilities were discovered in Mahara, an electronic portfolio, weblog, and resume builder : - CVE-2011-2771 Teemu Vesala discovered that missing input sanitising of RSS feeds could lead to cross-site scripting. - CVE-2011-2772 Richard Mansfield discovered that insufficient upload...

[SECURITY] [DSA 2334-1] mahara security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2334-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 04, 2011 http://www.debian.org/security/faq -...

CVE-2011-3780: Exposure of Sensitive Information to an Unauthorized Actor

PHP iCalendar 2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by rss/rsscommon.php and certain other files...

PT-2011-4670

Name of the Vulnerable Software and Affected Versions PHP iCalendar version 2.4 Description The issue allows remote attackers to obtain sensitive information via a direct request to certain .php files. This is demonstrated by files such as rss/rss common.php, which reveals the installation path i...

Sage vulnerable to arbitrary script execution

Overview Sage is vulnerable to arbitrary script execution. Note that this vulnerability is different from JVN99203127. Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output...

JVN#30221194: Sage vulnerable to arbitrary script execution

Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's Mozilla...

JVN#99203127: Sage vulnerable to arbitrary script execution

Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's Mozilla...

Security issues addressed in Thunderbird 3.1.12 — Mozilla

Many of the issues listed below are not exploitable through mail since JavaScript is disabled by default in Thunderbird. These particular issues may be triggered while viewing RSS feeds and displaying full remote content rather than the feed summary. Addons that expose browser functionality may...

Debian: Security Advisory (DSA-2262-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-0244

WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds...

Input validation

WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds...

CVE-2011-0244

WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds...

CVE-2011-0244

WebKit in Apple Safari before 5.0.6 is vulnerable due to improper canonicalization of URLs within RSS feeds, enabling a user-assisted remote attacker to read arbitrary files. Impact: partial disclosure of data; exploit requires user interaction. Remediation: upgrade to Safari 5.0.6 or newer (as n...

CVE-2011-0244

WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds...

Harvard researcher arrested on hacking charges

Harvard researcher arrested on hacking charges A Harvard researcher Aaron Swartz has been arrested in Boston for broke into the computer networks at the Massachusetts Institute of Technology to gain access to JSTOR, a non-profit online service for distributing scholarly articles, and downloaded 4...