Oracle Reports Web Cartridge (RWCGI60)跨站脚本执行漏洞

Oracle应用服务器是一个综合解决方案，用于开发、集成和部署企业的应用系统、门户和网站。 Oracle应用服务Reports Web Cartridge在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在用户浏览器中执行恶意脚本代码。 在使用Oracle应用服务器处理Web客户端请求时，报表服务器必需Reports Web CGI或Web Cartridge。由于没有正确验证genuser参数，远程攻击者可以在输入中注入任意脚本并在客户端浏览器中执行。这一漏洞在认证表单中尤其严重，因为恶意用户可以通过这种攻击获得其他用户的认证凭据。 Oracle Application...

US-CERT Technical Cyber Security Alert TA07-022A

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-022A Sun Updates for Multiple Vulnerabilities in Java Original release date: January 22, 2007 Last revised: -- Source: US-CERT Systems Affected Sun Java Runtime Environment versions JDK a...

Adobe Acrobat allows pointer overwrite via specially crafted PDF file

Overview Adobe Acrobat and Adobe Reader fail to properly handle a specially crafted PDF file, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Adobe Acrobat and Adobe Reader are applications designed to create and view Portable Document Format PDF...

JVN#95249468 Fresh Reader RSS feed cross-site scripting vulnerability

Impact An arbitrary script could be executed on the web browser of a Fresh Reader user. Solution Products Affected Fresh Reader Ver 1.0.06053100 and earlier For more information, refer to the vendor's website...

Fedora Core 5 : mozilla-1.7.13-1.1.fc5 (2006-487)

Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bugs...

Fedora Core 5 : firefox-1.5.0.7-1.fc5 (2006-976)

Mozilla Firefox is an open source Web browser. Two flaws were found in the way Firefox processed certain regular expressions. A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox. CVE-2006-4565, CVE-2006-4566 A number of flaws were found in...

Fedora Core 5 : firefox-1.5.0.9-1.fc5 (2006-1499)

Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running...

Fedora Core 4 : mozilla-1.7.13-1.1.fc4 (2006-488)

Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bugs...

Fedora Core 6 : devhelp-0.12-9.fc6 / epiphany-2.16.2-1.fc6 / firefox-1.5.0.9-1.fc6 / etc (2006-1492)

Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running...

[SECURITY] Fedora Core 5 Update: w3m-0.5.1-15.fc5

The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML document, you can follow links and view images using an external image viewer; its internet message mode determines the type of document from t...

[SECURITY] Fedora Core 6 Update: w3m-0.5.1-15.fc6

The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML document, you can follow links and view images using an external image viewer; its internet message mode determines the type of document from t...

Microsoft Visual Studio 2005 WMI Object Broker vulnerability

Added: 01/15/2007 CVE: CVE-2006-4704 BID: 20843 OSVDB: 30155 Background Microsoft Visual Studio is a product to assist with software development in the Windows operating system. Problem A flaw in the WMI Object Broker ActiveX control allows attackers to bypass security zone restrictions, leading ...

Microsoft Visual Studio 2005 WMI Object Broker vulnerability

Added: 01/15/2007 CVE: CVE-2006-4704 BID: 20843 OSVDB: 30155 Background Microsoft Visual Studio is a product to assist with software development in the Windows operating system. Problem A flaw in the WMI Object Broker ActiveX control allows attackers to bypass security zone restrictions, leading ...

Opera: Two remote code execution vulnerabilities

Background Opera is a multi-platform web browser. Description Christoph Deal discovered that JPEG files with a specially crafted DHT marker can be exploited to cause a heap overflow. Furthermore, an anonymous person discovered that Opera does not correctly handle objects passed to the...

w3m: Format string vulnerability

Background w3m is a multi-platform text-based web browser. Description w3m in -dump or -backend mode does not correctly handle printf format string specifiers in the Common Name CN field of an X.509 SSL certificate. Impact An attacker could entice a user to visit a malicious website that would lo...

Opera Web浏览器JPEG图形DHT标记堆溢出漏洞

Opera是一款流行的WEB浏览器，支持多种平台。 Opera没有正确地处理JPEG文件头中的DHT标记，远程攻击者可能利用此漏洞控制用户机器。 如果DHT标记中包含有无效的索引字节数的话，攻击者就可以触发堆溢出，导致执行任意指令。 Opera Software Opera 9.02 Opera Software -------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.opera.com...

OmniWeb Browser < 5.5.2 Javascript alert Function Format String

Binary data 3879.prm...

iDefense Security Advisory 01.05.07: Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption Vulnerability

Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption Vulnerability iDefense Security Advisory 01.05.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 05, 2007 I. BACKGROUND Opera is a cross-platform web browser. More information is available at http://www.opera.com/ I...

iDefense Security Advisory 01.05.07: Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting Vulnerability

Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting Vulnerability iDefense Security Advisory 01.05.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 05, 2007 I. BACKGROUND Opera is a cross-platform web browser. More information is available at...

JVN#65500885 Serene Bach cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. Also, session information or credential information kept in a cookie could be leaked. Solution Products Affected Serene Bach ver 2.05R and earlier Serene Bach ver 2.08D and earlier sb 1.13D and earlier sb 1.18R and earlier...