Hidetake Jo

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Publisher (affected versions not specified) **Description** The issue is a security feature bypass vulnerability in Microsoft Office Publisher. It has been found exploited in the wild, affecting Microsoft products. There is no information provided about the estimated number of potentially affected devices worldwide or specific technical details about exploitation, such as API endpoints, vulnerable parameters, or function names. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Shell (affected versions not specified) **Description** The issue exists due to insufficient input validation in the Windows Shell component of the Windows operating system. This allows a remote attacker to execute arbitrary code in the context of the current user by using a specially crafted file. The vulnerability can be exploited by remote attackers to execute arbitrary code and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 5 **Description** A cross-site scripting (XSS) issue allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header. **Recommendations** For versions prior to 5, update to iOS version 5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 5.0.6 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted text/plain file. This could potentially lead to unauthorized actions on a user's session. **Recommendations** For versions prior to 5.0.6, update to version 5.0.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.0.x through 3.0.17 Mozilla Firefox versions 3.5.x through 3.5.7 SeaMonkey versions prior to 2.0.3 **Description** The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted `dialogArguments` values. This is due to improper restriction of read access to object properties in `showModalDialog`. **Recommendations** For Mozilla Firefox versions 3.0.x through 3.0.17, update to version 3.0.18 or later. For Mozilla Firefox versions 3.5.x through 3.5.7, update to version 3.5.8 or later. For SeaMonkey versions prior to 2.0.3, update to version 2.0.3 or later.