CVSS: 10.0EPSS: 96%CPEs: 9EXPL: 2CVE-2012-5076 – Oracle Java SE Sandbox Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2012-5076
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS. Una vulnerabilidad no especificada en el Java Runtime Environment (JRE) en el componente Oracle Java SE v7 Update 7 y versiones anteriores permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad. Se trata de un problema relacionado con JAX-WS. The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. • https://www.exploit-db.com/exploits/24309 https://www.exploit-db.com/exploits/22657 http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html http://rhn.redhat.com/errata/RHSA-2012-1386.html http://rhn.redhat.com/errata/RHSA-2012-1391.html http://rhn.redhat.com/errata/RHSA-2012-1467.html http://secunia.com/advisories/51029 http://secunia.com/advisories/51326 http://secunia.com/advisories/51390 http://security.gentoo.org/glsa/glsa-201406-32.xml http:& •
CVSS: 6.8EPSS: 1%CPEs: 22EXPL: 1CVE-2012-4193 – Mozilla: defaultValue security checks not applied (MFSA 2012-89)
https://notcve.org/view.php?id=CVE-2012-4193
Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. Mozilla Firefox anteriores a v16.0.1, Firefox ESR v10.x anteriores a v10.0.9, Thunderbird anteriores a v16.0.1, Thunderbird ESR v10.x anteriores a v10.0.9, y SeaMonkey anteriores a v2.13.1 omite un chekeo de seguridad en la función defaultValue durante el desempaqueta de una envoltura de seguridad, lo que permite a atacantes remotos evitar la política "Same Origin Policy" y leer las propiedades del objeto Location, or ejecutar código JavaScript a través de un sitio Web moficado. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://rhn.redhat.com/errata/RHSA-2012-1361.html http://rhn.redhat.com/errata/RHSA-2012-1362.html http://secunia.com/advisories/50904 http://secunia.com/advisories/50906 http://secunia.com/advisories/50907 http://secunia.com/advisories/50964 http://secunia.com/advisories/50984 http://secunia.com/advisories/55318 http://www.mozilla.org/security/announce/2012/mfsa2012-89.html http://www.ubuntu.com/ • CWE-346: Origin Validation Error •
CVSS: 6.8EPSS: 0%CPEs: 22EXPL: 0CVE-2012-4184 – Mozilla: Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties (MFSA 2012-83)
https://notcve.org/view.php?id=CVE-2012-4184
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not prevent access to properties of a prototype for a standard class, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site. La implementación Chrome Object Wrapper (COW) en Mozilla Firefox v16.0, Firefox ESR v10.x antes de v10.0.8, Thunderbird antes de v16.0, Thunderbird ESR v10.x antes de v10.0.8, y SeaMonkey antes de v2.13, no previene el acceso a las propiedades de un prototipo para una clase estandar, lo que permite a atacantes remotos ejecutar código JavaScript de su elección con privilegios chrome a través de una pagina web manipulada. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://osvdb.org/86113 http://rhn.redhat.com/errata/RHSA-2012-1351.html http://secunia.com/advisories/50892 http://secunia.com/advisories/50904 http://secunia.com/advisories/50984 http://secunia.com/advisories/55318 http://www.mandriva.com/security/advisories?name=MDVSA-2012:163 http://www.mozilla.org/security/announce/2012/mfsa2012-83.html http://www.securityfocus.com/bid/56120 http://www.ubuntu.c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 2%CPEs: 23EXPL: 0CVE-2012-4179 – Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)
https://notcve.org/view.php?id=CVE-2012-4179
Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Vulnerabilidad de uso después de liberación en la funciónn sHTMLCSSUtils::CreateCSSPropertyTxn en Mozilla Firefox v16.0, Firefox ESR v10.x antes de v10.0.8, Thunderbird antes de v16.0, Thunderbird ESR v10.x antes de v10.0.8, y SeaMonkey antes de v2.13, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria dinámica) a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://rhn.redhat.com/errata/RHSA-2012-1351.html http://secunia.com/advisories/50856 http://secunia.com/advisories/50892 http://secunia.com/advisories/50904 http://secunia.com/advisories/50935 http://secunia.com/advisories/50936 http://secunia.com/advisories/50984 http://secunia.com/advisories/51181 http://secunia.com/advisories/55318 http://www.debian.org/security/2012/dsa-2565 http://www.debian&# • CWE-125: Out-of-bounds Read CWE-416: Use After Free •
CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 0CVE-2012-3986 – Mozilla: Some DOMWindowUtils methods bypass security checks (MFSA 2012-77)
https://notcve.org/view.php?id=CVE-2012-3986
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code. Mozilla Firefox v16.0, Firefox ESR v10.x antes de v10.0.8, Thunderbird antes de v16.0, Thunderbird ESR v10.x antes de v10.0.8, y SeaMonkey antes de v2.13, no restringe correctamente las llamadas a métodos DOMWindowUtils (alias nsDOMWindowUtils), lo que permite a atacantes remotos evitar las restricciones de acceso a través de código JavaScript manipulado. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://rhn.redhat.com/errata/RHSA-2012-1351.html http://secunia.com/advisories/50856 http://secunia.com/advisories/50892 http://secunia.com/advisories/50904 http://secunia.com/advisories/50935 http://secunia.com/advisories/50936 http://secunia.com/advisories/50984 http://secunia.com/advisories/51181 http://secunia.com/advisories/55318 http://www.debian.org/security/2012/dsa-2565 http://www.debian&# • CWE-20: Improper Input Validation •