mozilla -- privilege escalation via DOM property overrides

A Mozilla Foundation Security Advisory reports: mozbugra4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu. The common cause in each case was privileg...

CVE-2004-1766

The CVE refers to NetScreen-Security Manager prior to Feature Pack 1 communicating with devices using ScreenOS 5.0 without encryption, allowing remote attackers to obtain sensitive information via sniffing. The available documents state the vulnerability and its impact (information disclosure) bu...

CVE-2004-1766

The default installation of NetScreen-Security Manager before Feature Pack 1 does not enable encryption for communication with devices running ScreenOS 5.0, which allows remote attackers to obtain sensitive information via sniffing...

CVE-2005-0231

Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."...

CVE-2005-0231

Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."...

CVE-2005-0231

Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."...

CVE-2002-0712

Entrust Authority Security Manager EASM 6.0 does not properly require multiple master users to change the password of a master user, which could allow a master user to perform operations that require multiple authorizations...

NetScreen-Security Manager fails to encrypt communications with managed devices

Overview A vulnerability in the NetScreen-Security Manager software could expose sensitive information in cleartext over the network. Description NetScreen Technologies' NetScreen-Security Manager provides centralized management for control of device configuration, network settings and security...

CVE-2004-1766

The default installation of NetScreen-Security Manager before Feature Pack 1 does not enable encryption for communication with devices running ScreenOS 5.0, which allows remote attackers to obtain sensitive information via sniffing...

Proof-Of-Concept Denial-Of-Service Pointbase 4.6 Java SQL-DB

Hi, the following code crashes the Pointbase 4.6 database that comes with the J2EE reference implementation. It is provided as an ant script for flexibility and to illustrate the involved ressources. This is a cross-platform denial-of-service java exploit, caused by fact that the pointbase...

j2ee.pointbase.txt

Hi, the following code crashes the Pointbase 4.6 database that comes with the J2EE reference implementation. It is provided as an ant script for flexibility and to illustrate the involved ressources. This is a cross-platform denial-of-service java exploit, caused by fact that the pointbase...

CVE-2002-0712

Entrust Authority Security Manager EASM 6.0 does not properly require multiple master users to change the password of a master user, which could allow a master user to perform operations that require multiple authorizations...

CVE-2002-0712

CVE-2002-0712 (Entrust EASM 6.0) : The vulnerability exists in Entrust Authority Security Manager where the multiple-authorization requirement for sensitive master-user functions is not enforced for changing another master user’s password, enabling a single master user to impersonate another and ...

Sun Microsystems Java Virtual Machine 1.x - Security Manager Denial of Service

Sun Microsystems Java Virtual Machine 1.x - Security Manager Denial of Service source: https://www.securityfocus.com/bid/8892/info A problem has been reported in the Sun Microsystems Java Virtual Machine that occurs when implementing the Security Manager. Because of this, an attacker may be able ...

Sun Microsystems Java Virtual Machine 1.x - Security Manager Denial of Service

source: https://www.securityfocus.com/bid/8892/info A problem has been reported in the Sun Microsystems Java Virtual Machine that occurs when implementing the Security Manager. Because of this, an attacker may be able to crash the virtual machine. / InsecurityManager-Demonstration / / coded by Ma...

CVE-2003-0896

The CVE-2003-0896 entry concerns the loadClass method of sun.applet.AppletClassLoader in the JVM used with Sun SDK/JRE 1.4.1_03 and earlier. A remote attacker can bypass sandbox restrictions and execute arbitrary code by loading a class name that uses "/" instead of "." (dot), which avoids the Se...

Fixed in Apache Tomcat 3.3.1a

Important: Information disclosure CVE-2003-0043 When used with JDK 1.3.1 or earlier, web.xml files were read with trusted privileges enabling files outside of the web application to be read even when running under a security manager. Affects: 3.0, 3.1-3.1.1, 3.2-3.2.4, 3.3a-3.3.1 Important:...

Microsoft Virtual Machine allows applets write access to the Standard Security Manager

Overview A flaw in the Microsoft virtual machine Microsoft VM could allow malicious Java applets to block other, legitimate applets from running, resulting in a denial-of-service condition. Description The Microsoft virtual machine Microsoft VM enables Java programs to run on Windows platforms. T...

CVE-2002-1292

The CVE-2002-1292 entry concerns the Microsoft Java VM (MSJVM) in Internet Explorer up to build 5.0.3805. A vulnerability allows remote attackers to extend the Standard Security Manager (com.ms.security.StandardSecurityManager) by modifying deniedDefinitionPackages or deniedAccessPackages, leadin...

CVE-2002-1292

The Microsoft Java virtual machine VM build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager SSM class com.ms.security.StandardSecurityManager and bypass intended StandardSecurityManager restrictions by modifying the 1...