5379 matches found
Mozilla Foundation Security Advisory 2008-10
Mozilla Foundation Security Advisory 2008-10 Title: URL token stealing via stylesheet redirect Impact: Low Announced: February 7, 2008 Reporter: Martin Straka Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.12 SeaMonkey 1.1.8 Description Security researcher Martin Straka reported that...
Design/Logic Flaw
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original UR...
CVE-2008-0593
CVE-2008-0593 affects Gecko-based browsers, notably Firefox < 2.0.0.12 and SeaMonkey
Mozilla URL token stealing flaw
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original UR...
Mozilla URL token stealing flaw
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original UR...
Mozilla URL token stealing flaw
Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original UR...
URL token stealing via stylesheet redirect — Mozilla
Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects much as the document.location property is updated. This differs from other browsers and could...
Debian Security Advisory DSA 1468-1 (tomcat5.5)
The remote host is missing an update to tomcat5.5 announced via advisory DSA 1468-1. OpenVAS Vulnerability Test $Id: deb14681.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1468-1 tomcat5.5 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
esmart-bypass.txt
Aria-Security Team http://aria-security.net -------------------------------------- Vendor :http://www.preproject.com Script/Portal: E-SMART CART You can bypass the login page with: ' or ' Shouts :theoutl4w...
Unfixed XSS vulnerability at www.single-russian-woman.com
Security researcher TreX, has submitted on 12/12/2007 a cross-site-scripting XSS vulnerability affecting www.single-russian-woman.com, which at the time of submission ranked 201873 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2007. It ...
Unfixed XSS vulnerability at www.single-russian-woman.com
Security researcher TreX, has submitted on 12/12/2007 a cross-site-scripting XSS vulnerability affecting www.single-russian-woman.com, which at the time of submission ranked 201873 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2007. It ...
Unfixed XSS vulnerability at www.single-russian-woman.com
Security researcher TreX, has submitted on 12/12/2007 a cross-site-scripting XSS vulnerability affecting www.single-russian-woman.com, which at the time of submission ranked 201873 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2007. It ...
Unfixed XSS vulnerability at www.single-russian-woman.com
Security researcher TreX, has submitted on 12/12/2007 a cross-site-scripting XSS vulnerability affecting www.single-russian-woman.com, which at the time of submission ranked 201873 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2007. It ...
Unfixed XSS vulnerability at www.single-russian-woman.com
Security researcher TreX, has submitted on 12/12/2007 a cross-site-scripting XSS vulnerability affecting www.single-russian-woman.com, which at the time of submission ranked 201873 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2007. It ...
Unfixed XSS vulnerability at www.single-russian-woman.com
Security researcher TreX, has submitted on 12/12/2007 a cross-site-scripting XSS vulnerability affecting www.single-russian-woman.com, which at the time of submission ranked 201873 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2007. It ...
tomcat handling of cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...
tomcat handling of cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...
NULL pointer dereference triggered by ptrace
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs the xcs field during ptrace single-step operations, which allows local users to cause a denial of service NULL dereference and OOPS via certain code that makes ptrace PTRACESETREGS and...
Design/Logic Flaw
Unspecified vulnerability in the Oracle Single Sign-On component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.2, and 10.1.4.0.1; Collaboration Suite 10.1.2; and Enterprise Manager 10.1.2 has unknown impact and remote attack vectors, aka AS10...
CVE-2007-5524
Unspecified vulnerability in the Oracle Single Sign-On component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS09 or AS9...