Touch events are shared across iframes — Mozilla

Mozilla developer Wesley Johnston reported that when there are two or more iframes on the same HTML page, an iframe is able to see the touch events and their targets that occur within the other iframes on the page. If the iframes are from the same origin, they can also access the properties and...

OPlayer 2.0.05 iOS Cross Site Scripting

Title: ====== OPlayer v2.0.05 iOS - Multiple Web Vulnerabilities Date: ===== 2012-10-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=715 VL-ID: ===== 719 Common Vulnerability Scoring System: ==================================== 4.5 Introduction: ============= OPlayer...

CVE-2012-4249

The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...

CVE-2012-4248

The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the 1 dev.log, 2 lipc.set, 3 lipc.get, or 4 todo.scheduleItems method, a different...

Design/Logic Flaw

The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the 1 dev.log, 2 lipc.set, 3 lipc.get, or 4 todo.scheduleItems method, a different...

Code injection

The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...

CVE-2012-4249

The vulnerability CVE-2012-4249 affects Amazon Kindle Touch prior to 5.1.2, specifically the com.lab126.system sendEvent implementation. The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, demonstrated by lipc-set-prop to set an LIPC pr...

CVE-2012-4249

The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...

CVE-2012-4248

The data confirms CVE-2012-4248 affects Kindle Touch prior to 5.1.2, where access to the libkindleplugin.so NPAPI plugin interface is not properly restricted. This may allow remote attackers to cause unspecified impact via the dev.log, lipc.set, lipc.get, or todo.scheduleItems methods. The root c...

CVE-2012-4248

The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the 1 dev.log, 2 lipc.set, 3 lipc.get, or 4 todo.scheduleItems method, a different...

CVE-2012-2648

Cross-site scripting XSS vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the iPhone and iPod touch, allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction with a web browser...

CVE-2012-2648

CVE-2012-2648 is a cross-site scripting (XSS) vulnerability in the GoodReader app for iOS. The issue affects GoodReader versions 3.16 and earlier on the iPad and 3.15.1 and earlier on iPhone/iPod touch, where, when used in conjunction with a web browser, an attacker could inject arbitrary web scr...

CVE-2012-2648

Cross-site scripting XSS vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the iPhone and iPod touch, allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction with a web browser...

JVN#01598734: GoodReader vulnerable to cross-site scripting

GoodReader is a document reader for Apple mobile devices. GoodReader contains a cross-site scripting vulnerability. Impact When GoodReader is used through a web browser, an arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version...

Amazon Kindle Touch libkindleplugin scriptable browser plugin vulnerability

Overview Kindle Touch 5.1.0 contains a scriptable browser plugin which can be invoked by accessing a malicious web page. Description It has been reported that Kindle Touch 5.1.0 has introduced a NPAPI plugin /usr/lib/libkindleplugin.so symlinked to /usrl/lib/browser/plugins/libkindleplugin.so tha...

Kindle Touch a remote code execution vulnerability-vulnerability warning-the black bar safety net

I don't know if amazon kindle fans? Recent foreign media reports, the Kindle Touch appears a remote executable code vulnerabilities. For Kindle Touch 5.1.0 firmware version, you can remotely execute code, The/etc/shadow file is sent to the specifiedweb server. Vulnerability relates to...

Facebook Issues Security Updates for Mobile App

The Facebook security team is adding some new security features to the social network’s mobile applications, including upgrades to the login mechanism and account recovery options. The first addition is an update to Facebook’s existing login approval mechanism, which they are calling ‘code...

Apple iOS 5.1.1 Safari Browser - JS match() search() Crash (PoC)

Apple iOS 5.1.1 Safari Browser - JS match search Crash PoC !/usr/bin/env ruby - Title iOS \n\ Crash PoC\n\ \n\ var s = "poc";\n\ s.match"chrbufferlen";\n\ \n\ "; def help puts "iOS = v5.1.1 Safari Browser JS match, search Crash PoC" puts "$0 -p bindport -h bindaddress --verbose" end Parsing...

Fedora Update for usbmuxd FEDORA-2012-1192

Check for the Version of usbmuxd OpenVAS Vulnerability Test Fedora Update for usbmuxd FEDORA-2012-1192 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for ktouch FEDORA-2011-13417

Check for the Version of ktouch OpenVAS Vulnerability Test Fedora Update for ktouch FEDORA-2011-13417 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...