Apple Safari 'javascript: URI' XSS Vulnerability - Sep09

This host is installed with Apple Safari Web Browser and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: gbapplesafarijsurixssvulnsep09.nasl 4865 2016-12-28 16:16:43Z teissa $ Apple Safari 'javascript: URI' XSS Vulnerability - Sep09 Authors: Sharath S Copyright:...

CVE-2009-3017

Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, ...

CVE-2009-3011

Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains...

CVE-2009-3013

Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Location header that contains JavaScript sequences in a...

CVE-2009-3014

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting...

CVE-2009-3015

QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains a javascript: URI, 2...

Cross site scripting

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Location header that contains JavaScript...

Cross site scripting

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting ...

Cross site scripting

Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Location header that contains JavaScript sequences in a...

CVE-2009-3012

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Location header that contains JavaScript...

CVE-2009-3014

This CVE (CVE-2009-3014) concerns multiple Mozilla products: Firefox up to 3.0.13 and earlier, plus versions in the 3.5, 3.6 a1 pre, and 3.7 a1 pre series; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier. The vulnerability arises from improper handling of javascript: URIs in HTML links inside 302...

CVE-2009-3011

Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header that contains...

CVE-2009-3012

The CVE-2009-3012 entry affects Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre. The vulnerability arises because Firefox does not properly block data: URIs in Location headers in HTTP responses, enabling remote XSS via two vectors: (1) a Location header containing a data:text...

PHP-Fusion 6.1.18 - Multiple Information Disclosure Vulnerabilities

PHP-Fusion 6.1.18 - Multiple Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/36171/info PHP-Fusion is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to harvest sensitive information that may lead to further attacks. Th...

PHP-Fusion 6.1.18 - Multiple Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/36171/info PHP-Fusion is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to harvest sensitive information that may lead to further attacks. The following example URIs are available:...

OpenAutoClassifieds 1.5.9 - SQL Injection

source: https://www.securityfocus.com/bid/36173/info OpenAutoClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application,...

Netgear WNR2000 - Multiple Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/36076/info The NetGear WNR2000 is prone to multiple remote information-disclosure issues because it fails to restrict access to sensitive information. A remote attacker exploit these issues to obtain sensitive information, possibly aiding in further...

Microsoft Internet Explorer XSS Vulnerability - July09

The host is installed with Internet Explorer and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: gbmsiexssvulnjul09.nasl 6527 2017-07-05 05:56:34Z cfischer $ Microsoft Internet Explorer XSS Vulnerability - July09 Authors: Nikita MR Copyright: Copyright c 2009...

Google Chrome Cross-Site Scripting Vulnerability - July09

This host has Google Chrome installed and is prone to Cross-Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: gbgooglechromexssvulnjul09.nasl 4869 2016-12-29 11:01:45Z teissa $ Google Chrome Cross-Site Scripting Vulnerability - July09 Authors: Sharath S Copyright: Copyright c 2009...

CVE-2009-2352

Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header or 2 specifying the content of a Refresh header, a related issue...