Apple WebKit: UXSS via FrameLoader::clear (CVE-2017-2363)

When the new page is loading, FrameLoader::clear is called to clear the old document and window. Here's a snippet of FrameLoader::clear. void FrameLoader::clearDocument newDocument, bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView ... // Do this after detaching the documen...

CVE-2017-2363

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain...

CVE-2017-2363

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain...

CVE-2017-2363

CVE-2017-2363 affects Apple WebKit components across iOS (iOS before 10.2.1), Safari (before 10.0.3), tvOS (before 10.1.1) and watchOS (before 3.1.3). The issue permits a remote attacker to bypass the Same Origin Policy and exfiltrate sensitive data via a crafted web site, due to a WebKit prototy...

CVE-2016-2363

Fonality previously trixbox Pro 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account...

CVE-2016-2363

Fonality previously trixbox Pro 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account...

CVE-2016-2363

CVE-2016-2363 affects Fonality (formerly trixbox Pro) 12.6–14.1i before 2016-06-01. The vulnerability arises from weak permissions on the /var/www/rpc/surun script, enabling local users to exploit the nobody account to execute commands as root. Impact is local privilege escalation with full contr...

Oracle: Security Advisory (ELSA-2011-0885)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Kernel-Mode Driver Privilege Elevation Vulnerabilities (3070102)

This host is missing an important security update according to Microsoft Bulletin MS15-073. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-2363

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k...

CVE-2015-2363

CVE-2015-2363 affects Windows kernel-mode graphics/driver component Win32k.sys, enabling local privilege escalation via a crafted application. Affected products include Windows Server 2003 SP2/R2 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server ...

MS15-073: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (3070102)

The remote Windows host is affected by multiple vulnerabilities : - Multiple privilege escalation vulnerabilities exist in the Windows kernel-mode driver due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, with a specially crafted application, to...

Microsoft Windows Kernel 'Win32k.sys' CVE-2015-2363 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5.0 Avaya CallPilot 5.0....

Moodle 2.0.x < 2.0.9 / 2.1.x < 2.1.6 / 2.2.x < 2.2.3 Multiple Vulnerabilities

Binary data 8714.prm...

Ubuntu: Security Advisory (USN-2363-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-2363-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2363

The CVE-2014-2363 entry affects Morpho Itemiser 3, specifically version 8.17, which has hardcoded administrative credentials in the device. The underlying issue enables remote authentication bypass, giving an attacker with network access the ability to log in as an administrator, read and write t...

openSUSE Security Update : MozillaFirefox (MozillaFirefox-4761)

Mozilla Firefox was updated to the 3.6.18 security release. - MFSA 2011-19/CVE-2011-2374 CVE-2011-2376 CVE-2011-2364 CVE-2011-2365 Miscellaneous memory safety hazards - MFSA 2011-20/CVE-2011-2373 bmo617247 Use-after-free vulnerability when viewing XUL document with script disabled - MFSA...

openSUSE Security Update : mozilla-js192 (mozilla-js192-4771)

mozilla-xulrunner192 was updated to the 1.9.2.18 security release. dbg114-mozilla-js192-4771 mozilla-js192-4771 newupdateinfo MFSA 2011-19/CVE-2011-2374 CVE-2011-2376 CVE-2011-2364 CVE-2011-2365 Miscellaneous memory safety hazards dbg114-mozilla-js192-4771 mozilla-js192-4771 newupdateinfo MFSA...

Morpho Itemiser 3 Hard-Coded Credential

OVERVIEW Independent researchers Billy Rios and Terry McCorkle have identified hard-coded credentials in the Morpho Itemiser 3. Morpho has not produced a patch, update, or new version that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The followin...