Collin Jackson

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after `document.domain` has been set, due to improper implementation of the HTML5 Same Origin Policy.

The issue is related to the Android browser's inability to properly restrict modifications to cookies established in HTTPS sessions. This allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response. The problem is connected to the lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, which is described as a "cookie forcing" issue.

The issue is related to Microsoft Internet Explorer's inability to properly restrict modifications to cookies established in HTTPS sessions. This allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response. The problem is connected to the lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, which is described as a "cookie forcing" issue.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.11 Description: The issue allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document. This is achieved through a "file-URL-to-file-URL scripting" attack, where an incorrect principal is associated with a file: URL loaded through the location bar. Recommendations: For versions prior to 3.0.11, update to version 3.0.11 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via submission of a form to the "about:blank" URL, leading to security-context replacement. Recommendations: For Apple Safari versions prior to 4.0, update to version 4.0 or later. For iPhone OS versions 1.0 through 2.2.1, update to a version later than 2.2.1. For iPhone OS for iPod touch versions 1.1 through 2.2.1, update to a version later than 2.2.1.

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via specific vectors related to determining a security context, using an approach that does not follow the "HTML 5 standard method". Recommendations: For Apple Safari versions prior to 4.0, update to version 4.0 or later. For iPhone OS versions 1.0 through 2.2.1, update to a version later than 2.2.1. For iPhone OS for iPod touch versions 1.1 through 2.2.1, update to a version later than 2.2.1.

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 Description: A cross-site scripting (XSS) issue exists in Web Inspector in WebKit, allowing user-assisted remote attackers to inject arbitrary web script or HTML and read local files. This occurs due to incorrect privileges during script execution. Recommendations: For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

The issue is related to the improper implementation of JAR signing, which allows remote attackers to execute arbitrary code. This can be achieved through the injection of JavaScript into documents within a JAR archive or by using a JAR archive that utilizes relative URLs to JavaScript files.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the document.domain property.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by using the `window.open` function to change the security context of a web page.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the `document.domain` property or have the same `document.domain`.