236 matches found
Apache Tomcat 7.0.0 < 7.0.53 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 7.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.53security-7 advisory. - Integer overflow in the parseChunkHeader function in...
Apache Tomcat 8.0.0-RC1 < 8.0.5 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 8.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.0.5security-8 advisory. - Integer overflow in the parseChunkHeader function in...
tomcat -- multiple vulnerabilities
Tomcat Security Team reports: Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference,...
Apache Camel XSLT Component XML External Entity (CVE-2014-0002)
An XML External Entity XXE vulnerability has been reported in Apache Camel. The vulnerability is due to an error in handling XSL stylesheets in the XSLT component. A remote, unauthenticated attacker can exploit this vulnerability to disclose the contents of files accessible to Apache Camel's Java...
SeaMonkey Multiple Vulnerabilities-01 (Feb 2014) - Mac OS X
SeaMonkey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:seamonkey"; ifdescription...
CVE-2014-1485
The Content Security Policy CSP implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient...
Code injection
The Content Security Policy CSP implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient...
SeaMonkey < 2.24 Multiple Vulnerabilities
Binary data 8099.prm...
XSLT stylesheets treated as styles in Content Security Policy — Mozilla
Mozilla security engineer Frederik Braun reported an issue where the implementation of Content Security Policy CSP is not in compliance with the specification. XSLT stylesheets must be subject to script-src directives but Mozilla's implementation of CSP treats them as styles. This could lead to...
Solr: directory traversal when loading XSL stylesheets and Velocity templates
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. dot dot or full pathname in the tr parameter to solr/select/, when the response writer wt parameter is set to XSLT. NOTE: this can be leveraged using a separa...
Use-after-free in Animation Manager during stylesheet cloning — Mozilla
Security researcher Abhishek Arya Inferno of the Google Chrome Security Team used the Address Sanitizer tool to discover a use-after-free problem in the Animation Manager during the cloning of stylesheets. This can lead to a potentially exploitable crash...
Fedora 18 : libxslt-1.1.28-1.fc18 (2013-4507)
Update to libxslt-1.1.28 to fix CVE-2012-6139 where the library could crash on invalid key references in stylesheets Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format...
SuSE 11.2 Security Update : PHP5 (SAT Patch Number 5958)
This update of PHP5 fixes multiple security flaws : - missing checks of return values could allow remote attackers to cause a denial of service NULL pointer dereference. CVE-2011-4153 - specially crafted XSLT stylesheets could allow remote attackers to create arbitrary files with arbitrary conten...
Mozilla Thunderbird 3.1.x Multiple Vulnerabilities
Binary data 801371.prm...
Mozilla Firefox 3.6.x < 3.6.26 Multiple Vulnerabilities
Binary data 6307.prm...
Mozilla Thunderbird 3.1.x < 3.1.18 Multiple Vulnerabilities
Binary data 6309.prm...
FreeBSD : mozilla -- multiple vulnerabilities (0a9e2b72-4cb7-11e1-9146-14dae9ebcf89)
The Mozilla Project reports : MFSA 2012-01 Miscellaneous memory safety hazards rv:10.0/ rv:1.9.2.26 MFSA 2012-02 Overly permissive IPv6 literal syntax MFSA 2012-03 iframe element exposed across domains via name attribute MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal ...
Firefox 3.6 < 3.6.26 Multiple Vulnerabilities (Mac OS X)
The installed version of Firefox 3.6 is earlier than 3.6.26. Such versions are potentially affected by multiple vulnerabilities : - A use-after-free error exists related to removed nsDOMAttribute child nodes.CVE-2011-3659 - The IPv6 literal syntax in web addresses is not being properly enforced...
Mozilla Thunderbird 3.1.x < 3.1.18 Multiple Vulnerabilities
The installed version of Thunderbird 3.1.x is earlier than 3.1.18 and is, therefore, potentially affected by the following vulnerabilities: - A use-after-free error exists related to removed nsDOMAttribute child nodes.CVE-2011-3659 - The IPv6 literal syntax in web addresses is not being properly...
