Mario Heiderich

**Nome do software vulnerável e versões afetadas: Eucalyptus Management Console (EMC), versões 4.0.0 a 4.0.0 Descrição: O problema é uma vulnerabilidade de cross-site scripting (XSS) que permite que invasores remotos injetem scripts da web ou HTML arbitrários por meio de vetores não especificados. Recomendações: Para as versões 4.0.0 a 4.0.0, atualize para a versão 4.0.1 ou posterior para resolver o problema.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

A DOMParser XSS issue was discovered in certain Apple products, involving the WebKit component.

The issue exists due to inadequate protection of the web page structure in Microsoft Edge, allowing a remote attacker to conduct XSS attacks or obtain confidential information through unspecified vectors.

The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the `jsinitfunction` parameter. This can be demonstrated by using "jsinitfunctio%gn" as an example of the obfuscated form.

The issue is related to an improper whitelist in the Reader View implementation, making it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism. This allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.

The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including a crafted table name, a crafted mysqld log bin directive, the Transformation implementation, AJAX error handling, the Designer implementation, the charts implementation, or the zoom-search implementation.

The issue involves multiple cross-site scripting (XSS) vulnerabilities in WebKit. These vulnerabilities allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving drag-and-drop or copy-and-paste operations.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed, due to improper handling of EMBED elements within description elements in RSS feeds by an unspecified parser-utility class.

The issue allows remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity.

The issue is related to an integer overflow in the `xml utf8 decode` function, which can be exploited by remote attackers using a crafted string with overlong UTF-8 encoding. This allows attackers to bypass protection mechanisms against cross-site scripting (XSS) and SQL injection.

The issue allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) properties, specifically (1) background-image, (2) background, or (3) font-family, when Internet Explorer is used.

The issue allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) `@import` rule. An information disclosure vulnerability exists in the way that the `SafeHTML` function and the `toStaticHTML` API sanitize HTML, which could allow an attacker to perform cross-site scripting attacks and run script in the security context of the logged-on user. This could enable the attacker to execute a cross-site scripting attack on the user, allowing the execution of script in the user's security context against a site that is using the `toStaticHTML` API.