CVE-2010-3971
HighSummary
Podatność typu use-after-free w funkcji CSharedStyleSheet::Notify w parserze arkuszy stylów (CSS) w mshtml.dll, używanym w Microsoft Internet Explorer 6-8 oraz innych produktach, umożliwia zdalnym atakującym wykonanie dowolnego kodu lub spowodowanie awarii aplikacji poprzez samoodwołującą się regułę @import w arkuszu stylów.
Risk Assessment
Podatność ta stwarza ryzyko wykonania złośliwego kodu przez atakujących, co może prowadzić do utraty danych lub przejęcia kontroli nad systemem. Dodatkowo, może powodować awarie aplikacji, co wpływa na dostępność usług.
Recommendation
Zaleca się aktualizację przeglądarki Internet Explorer do najnowszej wersji oraz zastosowanie odpowiednich poprawek bezpieczeństwa. Należy również monitorować i ograniczać użycie arkuszy stylów w aplikacjach webowych.
Related vulnerabilities
- CVE-2026-76461CriticalActively exploited
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway is due to insufficient validation in the parsing logic. An unauthenticated remote attacker could send a crafted email containing malicious SQL statements, potentially leading to execution of arbitrary SQL statements and command execution with root privileges on the underlying operating system.
- CVE-2026-76443Critical
The vulnerabilities tracked by CVE-2026-76443 relate to improper neutralization issues grouped under CWE Pillar CWE-707 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-76441Critical
The vulnerabilities tracked by CVE-2026-76441 relate to improper access control issues grouped under CWE Pillar CWE-284 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-76440Critical
The vulnerabilities tracked by CVE-2026-76440 relate to path traversal issues grouped under CWE Pillar CWE-23 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-20353Critical
The vulnerabilities tracked by CVE-2026-20353 relate to improper control of a resource through its lifetime grouped under CWE Pillar CWE-664 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-61534Critical
In the Yayson library for serializing and reading JSON API data in JavaScript, prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. This can result in process-wide prototype pollution, causing denial of service and logic corruption.
- CVE-2026-57145Critical
In PraisonAI, a multi-agent teams system, prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read or overwrite files.
- CVE-2026-57131Critical
In PraisonAI, a multi-agent teams system, prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs.
- CVE-2026-82435Critical
In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.
- CVE-2026-90961Critical
The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.
Original NVD description (English source)
Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a self-referential @import rule in a stylesheet, aka "CSS Memory Corruption Vulnerability."