Cross site scripting

Cross-site scripting XSS vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set...

CVE-2012-0471

Cross-site scripting XSS vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set...

CVE-2012-0471

Cross-site scripting XSS vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set...

OpenJDK: unrestricted use of TimeZone.setDefault() (i18n, 7110687)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality,...

CentOS 6 : kernel (CESA-2012:0481)

Updated kernel packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores...

kernel: regset: Prevent null pointer reference on readonly regsets

The regset aka register set feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service NULL pointer dereference or possibly have unspecified other impact via a 1 PTRACEGETREGSET or 2 PTRACESETREGSE...

SuSE 11.2 Security Update : PHP5 (SAT Patch Number 5958)

This update of PHP5 fixes multiple security flaws : - missing checks of return values could allow remote attackers to cause a denial of service NULL pointer dereference. CVE-2011-4153 - specially crafted XSLT stylesheets could allow remote attackers to create arbitrary files with arbitrary conten...

Advanced POWER Web Hosting Cross Site Request Forgery

Exploit Title: Advanced POWER Web Hosting CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/advanced-power-web-hosting-directory-script-php/22752/ Category:: webapps Demo : http://www.softbizscripts.com/scripts/hostdirectory/admin Greetz: Inj3ct0r Exploit DataBase...

CVE-2012-1837

The 1 webreports, 2 post/create-role, and 3 post/update-role programs in IBM Tivoli Endpoint Manager TEM before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to thi...

CVE-2012-1837

CVE-2012-1837 affects IBM Tivoli Endpoint Manager (TEM) prior to 8.2. The issue arises where the following TEM components—webreports , post/create-role , and post/update-role —do not set the HTTPOnly flag in a Set-Cookie header, enabling potential script access to the cookie and potential informa...

CVE-2012-1097

The regset aka register set feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service NULL pointer dereference or possibly have unspecified other impact via a 1 PTRACEGETREGSET or 2 PTRACESETREGSE...

kernel: crypto: ghash: null pointer deref if no key is set

crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service NULL pointer dereference and OOPS or possibly have unspecified other impact by triggering a failed or missing ghashsetkey function call, followed by a 1 ghashupdate function call or 2 ghashfinal...

Adobe Flash Player MP4 Sequence Parameter Set Processing

Added: 02/09/2012 CVE: CVE-2011-2140 BID: 49083 OSVDB: 74439 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem The Adobe Flash Player Sub1005B396 function allows command execution when a user opens a specially crafted .swf file...

Adobe Flash Player MP4 Sequence Parameter Set Processing

Added: 02/09/2012 CVE: CVE-2011-2140 BID: 49083 OSVDB: 74439 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem The Adobe Flash Player Sub1005B396 function allows command execution when a user opens a specially crafted .swf file...

Adobe Flash Player MP4 Sequence Parameter Set Processing

Added: 02/09/2012 CVE: CVE-2011-2140 BID: 49083 OSVDB: 74439 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem The Adobe Flash Player Sub1005B396 function allows command execution when a user opens a specially crafted .swf file...

CVE-2012-0807

Stack-based buffer overflow in the suhosinencryptsinglecookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long...

Stack overflow

Stack-based buffer overflow in the suhosinencryptsinglecookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long...

CVE-2012-0807

Stack-based buffer overflow in the suhosinencryptsinglecookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long...

Revamped Pwn2Own to Offer $105K in Prizes, Cash From Google for Chrome 0-Days

The Pwn2Own contest at the CanSecWest conference has become one of the landmark events on the calendar each year, as researchers gather with nervous vendors in a tiny room to see who can own which browser on which platform and how quickly. But this year’s contest will have a much different look...

Multiple Cross Site Scripting ( #XSS ) Vulnerabilities in Forbes

Multiple Cross Site Scripting XSS Vulnerabilities in Forbes Ucha Gobejishvili longrifle0x , A Georgian Security Researcher Discover two Cross Site Scripting XSS Vulnerabilities on the Official website of Forbes, an American publishing and media company. Cross-Site Scripting occurs when an attacke...