147 matches found
CVE-2016-1564
CVE-2016-1564 affects WordPress core (before 4.4.1). The issue is multiple XSS in wp-includes/class-wp-theme.php that can be triggered by supplying a crafted (stylesheet name or template name) via wp-admin/customize.php. Underlying cause: insufficient input validation in the affected code path. I...
CVE-2016-1564
Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...
CVE-2016-1564
Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...
Debian: Security Advisory (DSA-3444-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Code injection
The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a deni...
CVE-2015-1564
Cross-site scripting XSS vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field...
CVE-2015-1564
CVE-2015-1564 affects Plain Black WebGUI 7.10.29 and earlier, via the style-underground/search component. The vulnerability is a cross-site scripting (XSS) flaw that lets remote attackers inject arbitrary web script or HTML through the Search field. No remediation details are provided in the conn...
Code injection
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and application crash via a crafted XML document containing a large number of nest...
Code injection
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service memory and CPU...
CVE-2014-4814
CVE-2014-4814 affects IBM WebSphere Portal versions 6.1.0 (through 6.1.0.6 CF27), 6.1.5 (through 6.1.5.3 CF27), 7.0 (through 7.0.0.2 CF28), 8.0 (through 8.0.0.1 CF14), and 8.5.0 before CF03. The issue is failure to properly detect recursion during entity expansion in XML, allowing remote authenti...
Code injection
IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service memory consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...
Code injection
IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service memory consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...
Uninit memory disclosure via truncated images in Firefox
Yello, The recent release of Firefox 32 fixes another interesting image parsing issue found by afl 1: following a refactoring of memory management code, the past few versions of the browser ended up using uninitialized memory for certain types of truncated images, which is easily measurable with ...
Ubuntu: Security Advisory (USN-2330-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2014:1098-1)
MozillaThunderbird was updated to Thunderbird 31.1.0 bnc894370, fixinfg security issues : - MFSA 2014-67/CVE-2014-1553/CVE-2014-1562 Miscellaneous memory safety hazards - MFSA 2014-68/CVE-2014-1563 bmo1018524 Use-after-free during DOM interactions with SVG - MFSA 2014-69/CVE-2014-1564 bmo1045977...
openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:1099-1)
Mozilla Firefox was updated to Firefox 32 fixing security issues and bugs. Security issues fixed: MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction...
openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2014:1098-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MozillaThunderbird: Update to 31.1 release (important)
MozillaThunderbird was updated to Thunderbird 31.1.0 bnc894370, fixinfg security issues: MFSA 2014-67/CVE-2014-1553/CVE-2014-1562 Miscellaneous memory safety hazards MFSA 2014-68/CVE-2014-1563 bmo1018524 Use-after-free during DOM interactions with SVG MFSA 2014-69/CVE-2014-1564 bmo1045977...
Mozilla Thunderbird Multiple Vulnerabilities-02 (Sep 2014) - Windows
Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...
CVE-2014-1564
CVE-2014-1564 affects Mozilla Firefox (and Firefox ESR 31.x) before version 32.0 and Thunderbird before 31.1. The issue is a memory initialization flaw in the GIF rendering path, causing an information leak from the process memory via crafted GIFs and interactions with a CANVAS element. Impact is...