Hidetake Jo

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Publisher (affected versions not specified) **Description** The issue is a security feature bypass vulnerability in Microsoft Office Publisher. It has been found exploited in the wild, affecting Microsoft products. There is no information provided about the estimated number of potentially affected devices worldwide or specific technical details about exploitation, such as API endpoints, vulnerable parameters, or function names. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Windows Shell (versões afetadas não especificadas) **Descrição** O problema existe devido à validação insuficiente de entradas no componente Windows Shell do sistema operacional Windows. Isso permite que um invasor remoto execute código arbitrário no contexto do usuário atual, utilizando um arquivo especialmente criado. A vulnerabilidade pode ser explorada por invasores remotos para executar código arbitrário e afetar o sistema. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 5 **Description** A cross-site scripting (XSS) issue allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header. **Recommendations** For versions prior to 5, update to iOS version 5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 5.0.6 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted text/plain file. This could potentially lead to unauthorized actions on a user's session. **Recommendations** For versions prior to 5.0.6, update to version 5.0.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.0.x through 3.0.17 Mozilla Firefox versions 3.5.x through 3.5.7 SeaMonkey versions prior to 2.0.3 **Description** The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted `dialogArguments` values. This is due to improper restriction of read access to object properties in `showModalDialog`. **Recommendations** For Mozilla Firefox versions 3.0.x through 3.0.17, update to version 3.0.18 or later. For Mozilla Firefox versions 3.5.x through 3.5.7, update to version 3.5.8 or later. For SeaMonkey versions prior to 2.0.3, update to version 2.0.3 or later.