691 matches found
zonnetprovedor.net.br Cross Site Scripting vulnerability OBB-1197853
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
com.github.goldin:about-maven-plugin (>=0.2.4, <=0.2.5), com.github.goldin:assert-maven-plugin (>=0.2.4, <=0.2.5) +67 more potentially affected by CVE-2018-10237 via org.sonatype.sisu:sisu-guava (0.11.1)
org.sonatype.sisu:sisu-guava MAVEN version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonatype.sisu:sisu-guava and may be impacted: - com.github.goldin:about-maven-plugin =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4, =0.2.4,...
Cherokee Cross-Site Scripting Vulnerability
Cherokee is an open source web server. A cross-site scripting vulnerability exists in the handlerserverinfo.c file in Cherokee 1.2.104 and earlier versions, which stems from a requested URL not being displayed correctly on the About page. An attacker can use this vulnerability to reconfigure the...
PT-2020-10768 · Cherokee · Cherokee
Name of the Vulnerable Software and Affected Versions: Cherokee versions 1.2.104 and earlier Description: A cross-site scripting XSS issue was discovered in the handler server info.c file. The requested URL is improperly displayed on the About page in the default configuration of the web server a...
CVE-2019-20798: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in handlerserverinfo.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and...
Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)
Exploit Title: Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow SEH Exploit Author: Bobby Cooke Date: 2020-04-11 Vendor: Drive Software Company Vendor Site: http://www.drive-software.com Software Download: http://www.drive-software.com/download/freeclock.exe Tested On:...
CVE-2019-20221
In Support Incident Tracker SiT! 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page...
About Author <= 1.3.9 - Authenticated Stored Cross-Site Scripting (XSS)
Wordpress About Author plugin with a version lower or equal with 1.3.9 is affected by an authenticated Stored Cross-site scripting XSS vulnerability. PoC Stored Cross-site scripting XSS: - Using an Wordpress user, access /wp-admin/post-new.php?posttype=aboutauthor About Author Add new - Insert in...
Firefox Blocks Inline and Eval JavaScript on Internal Pages to Prevent Injection Attacks
In an effort to mitigate a large class of potential cross-site scripting issues in Firefox, Mozilla has blocked execution of all inline scripts and potentially dangerous eval-like functions for built-in "about: pages" that are the gateway to sensitive preferences, settings, and statics of the...
CVE-2019-11747
CVE-2019-11747 affects Mozilla Firefox and Firefox ESR. The vulnerability stems from a bug in the History pane’s “Forget about this site” feature which, while intended to delete site-visit data, also removes HSTS settings for sites on the pre-load list. As a result, on the next visit, if a user u...
CVE-2019-11747
The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security HSTS settings received from sites that use it. Due to a bug, sites on the pre-load list also have...
UBUNTU-CVE-2019-11747
The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security HSTS settings received from sites that use it. Due to a bug, sites on the pre-load list also have...
UBUNTU-CVE-2018-18510
The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service DOS attack by a malicious site which links to these pages. This vulnerabilit...
CVE-2018-18495
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...
CVE-2018-18497
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This...
CVE-2018-18495
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...
Spoofing
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...
CVE-2018-18495
CVE-2018-18495 affects Mozilla Firefox prior to 64. WebExtension content scripts can be loaded into about: pages in certain circumstances, bypassing granted extension permissions and potentially letting an extension interfere with loading/usage of those pages. Implications include access to restr...
CVE-2018-18495
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...
CVE-2018-18497
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This...