CVE-2012-1965

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...

CVE-2012-1965

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...

CVE-2012-1965: Improper Neutralization of Input During Web Page Generation

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...

Mozilla: feed: URLs with an innerURI inherit security context of page (MFSA 2012-55)

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...

feed: URLs with an innerURI inherit security context of page — Mozilla

Security researchers Mario Gomes and Soroush Dalili reported that since Mozilla allows the pseudo-protocol feed: to prefix any valid URL, it is possible to construct feed:javascript: URLs that will execute scripts in some contexts. On some sites it may be possible to use this to evade output...

Internet Explorer Cached Object Remote Code Execution (MS12-044; CVE-2012-1522)

A remote code execution vulnerability has been reported in Internet Explorer. The vulnerability is due to an error in the way Internet Explorer accesses an object that has been deleted. A remote attacker can trigger this vulnerability by enticing an unsuspecting victim to open a specially crafted...

Adobe Photoshop TIFF Parsing Heap Buffer Overflow

A remote code execution vulnerability has been reported in Adobe Photoshop. The vulnerability is due to a heap buffer overflow when handling specially crafted TIFF files. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted TIFF file using an...

Oracle WebCenter Forms Recognition ActiveX Control Arbitrary File Creation (CVE-2012-1709)

A directory traversal vulnerability has been reported in Oracle WebCenter Forms Recognition. The vulnerability is due to insufficient validation of parameters used in certain methods in the CroProj.dll ActiveX control. A remote attacker can exploit this vulnerability by enticing a target user to...

libguestfs: virt-edit creates a new file, when it is used leading to loss of file attributes (permissions, owner, SELinux context etc.)

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

CVE-2012-3287

Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware...

Internet Explorer Col Element Remote Code Execution (MS12-037; CVE-2012-1876)

A memory corruption vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way Internet Explorer attempts to access a non-existent object. A remote attacker could trigger this vulnerability by enticing an unsuspecting victim to open a specially...

Internet Explorer Center Element Remote Code Execution (MS12-037; CVE-2012-1523)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way Internet Explorer accesses an object that has been deleted. A remote attacker could trigger this vulnerability by enticing an unsuspecting victim to open a...

Microsoft .NET Framework Function Pointer Remote Code Execution (MS12-038; CVE-2012-1855)

A remote code execution vulnerability has been reported in the Microsoft .NET Framework. The vulnerability is due to the improper execution of a function pointer by .NET Framework. A remote attacker could trigger this vulnerability by enticing an unsuspecting victim to open a specially crafted we...

Pretty Link Plugin for WordPress 'pretty-bar.php' 'url' Parameter XSS

The version of the Pretty Link Lite plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'url' parameter of the 'pretty-bar.php' script before using it to generate dynamic HTML output. An attacker can leverage this issue to inject arbitrary HTML...

Sharebar Plugin for WordPress 'sharebar-admin.php' 'status' Parameter XSS

The version of the Sharebar plugin for WordPress installed on the remote host is affected by a cross-site scripting vulnerability due to a failure properly sanitize user input to the 'status' parameter of the 'sharebar-admin.php' script before using it to generate dynamic HTML output. An attacker...

libpng png_decompress_chunk Integer Overflow - ver 2 (CVE-2011-3026)

An integer overflow vulnerability has been reported in libpng, an open source implementation of the PNG specification. The vulnerability is due to a heap allocation in the function pngdecompresschunk. Remote attackers could exploit this vulnerability by sending a specially crafted PNG file to the...

ASUS Net4Switch ipswcom.dll ActiveX Control Stack Buffer Overflow

A stack buffer overflow vulnerability has been reported in ASUS Net4Switch. The vulnerability is due to a boundary error in several methods of the ipswcom.dll ActiveX control. A remote attacker can exploit this vulnerability by enticing a target user to visit a specially crafted web-page...

Adobe Reader and Acrobat TTF MINDEX Code Execution (APSB12-08; CVE-2012-0774)

A remote code execution vulnerability has been reported in Adobe Reader and Acrobat. The vulnerability is due to incorrect memory buffer allocation while parsing a corrupted PDF file. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...

XSS in Kaseya version 6.2.0.0 web interface

Summary The Kaseya version 6.2.0.0 web interface and possibly other versions is vulnerable to Cross-Site Scripting in the "adminName" variable. 2. Description By submitting malicious input such as the following, it is possible to render javascript in the security context of the Kaseya server:...

Kaseya 6.2.0.0 Cross Site Scripting

Summary The Kaseya version 6.2.0.0 web interface and possibly other versions is vulnerable to Cross-Site Scripting in the "adminName" variable. 2. Description By submitting malicious input such as the following, it is possible to render javascript in the security context of the Kaseya server:...